Am pretty sure the course (really no user backups) could be 'pushed' to the LAN servers from the HUB instance where the courses are developed.
It's the second part ... that's still unclear to me ...
"This also means the LANs should be able to sync any update to the courses on the Hub."
So ... let's say a course called 'Moodle Basics' (MB for short) is developed and 'pushed' to the LAN servers. A week later (or sometime later), an addition is made to MB. It is desired that the addition now be added to the LAN MB courses?
There is a Moodle work-around to do that but it would mean a human located at the LAN servers would have to be involved ... basically a no user backup of MB that included only the newly added content. That backup made available or pushed to the LAN servers. The admin at the LAN server would have to restore that to the MB course and re-order/place the additions in the proper section etc. of the course.
Think it best to make sure that whatever is contained in a course to be pushed is really complete ... no new addtions needed.
If neither of the above acceptable, then think that leaves only LTI Tool on the LAN be added to the MB course that points to an LTI resource ... just the addition ... on the HUB. That would mean the LAN instances would be attempting to access content on the HUB - so that kinda rubs against what the overall design does.
Think there still would be need of a human at the LAN servers who have fairly good knowledge of how to do some things on the LAN servers.
To achieve total automation between LAN's and the HUB would involve DB replicaton setup between LAN's and possibly separate DB's (one for each LAN) on the DB server located at the HUB. This again means traffic on the upstream circuits.
Maybe if you could disclose some details about those upstream circuits ... IF, for example the connections from the LAN's are 56KB dry pair then or less than a T1 or a T1 with sporadic outages etc. think the setup of all of this would be in need of constant issues.
'spirit of sharing', Ken