Best Practice for deployment of code via Jenkins agent - direct on server or another way

The problem is that I cannot find a best practice on have to have a master server(with internet access) deploying to production servers (without internet). In this example is the Jenkins Master, test and build the artifacts and the Jenkins agent install the artifact on the server. I have found two scenarios: First scenarios – Jenkins agent installs sodtware via other protocols like SMD, RPC. Jenkins agent installs sodtware via other protocols

Second scenarios – Jenkins agent installed on production Jenkins agent installed on production

The second scenario where the Jenkins agent is installed on the production server is my best bet.

1. But I would like to hear if there are any problem regarding install a Jenkins agent on every production server running our build software?
2. Are the a better solution we can use?