Offline install fails because apt cache knows about grub-efi-amd64-signed from xenial-updates which is newer than the version in the ISOs' pool/ directory. Either the newest signed deb should be packed on the ISO (preferred) or it should be made sure that the apt cache only contains xenial stock without updates.