Updating OS on protected machine
You can download the installer on any other Mac. 
You may or may not be able to run the installer from your modified OS
You can always run a second OS on your Mac unless there is a firmware password too


Most management tools that can block the OTA install have also blocked he installer from running. The installer is trivial to block, the download much harder. 

Worst case, boot to Internet recovery and just install Yosemite on to a SD card or USB drive and migrate the data you need. 

That way, you still have the OS that is officially supported, but also an OS to run the tools you've decided you need. Don't write off IT - they may have a group for people that insist on the newest OS and use them for testing.