Windows 7 updates are still available, but what has changed is the digital signature on them. They are now signed with an algorithm called SHA-2, which Windows 7 can't recognize without updates.
If you somehow don't have Service Pack 1, your first step is getting that. That is KB976932. Make sure you get the proper 32-bit or 64-bit versions.
Next, you need Internet Explorer 11, even if you don't plan to use it. It upgrades internal components, so grab Internet Explorer 11 offline installer for the appropriate language.
Next is KB3050265 to fix a forever update loop on Windows Update.
Next is KB4490628, which updates the servicing stack in Windows for both the next update, and the SHA-2 update. The servicing stack is how Windows actually updates itself.
Almost there! The next is the motherlode, KB3125574, the closest thing we get to a Service Pack 2.
Finally, install the SHA-2 signing update, KB4474419. Once this update is done, you can do the rest via Windows Update.
So, to summarize: