It depends a bit on the recovery you use. But if your device has enough RAM, you could try to install the update via adb sideload.
If you encrypt "your phone", actually only the data partition gets encrypted. You can use Titanium Backup to back things up, but you will be out of luck regarding the data partition (and possibly internal sdcard, see below). If you use TWRP, it offers the option to unlock your encrypted /data when entering recovery, making a full backup possible. Also, using such a USB-OTG device allows you to update via ZIP directly from there!
Depending on your device, also the internal sdcard (and/or external - but you don't seem to have one) will get encrypted. In this case, your recovery will be unable to store the backup anywhere, but if you encrypt your phone you certainly don't want to store your backup unencrypted somewhere on the phone. Therefore, if your device supports USB-OTG, you could just connect an unencrypted usb stick for this purpose - this would be my recommendation.
Apart from that, you can always do "raw" backups directly via ADB by backup up unmounted partitions or even complete block devices. You should be familiar with the partition layout of your device in this case, or simply backup the complete flash (which might take a while). You would typically achieve this (just an example, you might have to use a different device name!):
adb pull /dev/block/mmcblk0
And to restore the backup:
adb push your-backupfile-of-mmcblk0 /dev/block/mmcblk0
But of course you can do this also just for individual partitions, e.g. /system:
adb pull /dev/block/sd.whatever/by-name/System
Check out the fstab.VENDOR file for your device (typically resides in your root directory), you should be able to find the proper device names in there.