He wouldn't even had to do that, as 9.6 is pretty new so if he have his N3DS since the launch, he would had the time to update emunand to 9.5, connect to eshop and download the updates and play his retail card on emunand.
But yeah, as you said, even without the eshop, the updates can still be installed as.cia files.
@
NEO117 : Yeah, N3DS 9.0 and Cubic Ninja is a yes

Just be sure to not update emunand as 9.6 is not supported yet, stay on 9.0, which change near nothing (except no eshop but you can still install the game updates, as said upper).