I use an alternative to apps_offline that seems to work very well, and I think very safe (and more customer friendly). You need access to IIS in order to do this, but I am wondering if anyone sees issues with this approach.
I create a separate website in IIS for upgrades, with a specific domain address used for upgrading only, with the portal alias already added on the sites with this address. When ready to upgrade, I change the path of the production website in IIS, to point to a different temporary folder, where there is a page with information about the maintenance, along with an estimate of time for returning (the customer friendly part). To the user, the site if offline.
I can then load the upgrade files, make any necessary adjustments, and access the site to perform the upgrade using the upgrade domain address. Once I am sure all is working properly, I then change the directory on the production website back to the production folder, and then stop the upgrade website in IIS. I can control what users see, provide information updates if need, and bring back the production site only when all is working properly.