how to update .env file in production while Jenkins deployment
You can store secret file at Jenkins and use it for deployment.
It can be achieved by using Credentials and Credentials Binding plugins.

Install Credentials Binding and Credentials plugins
Select your user name in the top navigation bar.
Select Credentials in the left pane.
Under Stores from parent, select (global) in the Domains column.
Select Add Credentials in the left pane.

insert into your pipeline script

  
withCredentials([file(credentialsId: 'env', variable: 'mySecretEnvFile')]){
    sh 'cp $mySecretEnvFile $WORKSPACE'
}