First, let's get some terminology out of the way.
The Gnus Agent is said to be unplugged when you have severed the connection to the net (and notified the Agent that this is the case). When the connection to the net is up again (and Gnus knows this), the Agent is plugged.
The local machine is the one you're running on, and which isn't connected to the net continuously.
Downloading means fetching things from the net to your local machine. Uploading is doing the opposite.
You know that Gnus gives you all the opportunity you'd ever want for shooting yourself in the foot. Some people call it flexibility. Gnus is also customizable to a great extent, which means that the user has a say on how Gnus behaves. Other newsreaders might unconditionally shoot you in your foot, but with Gnus, you have a choice!
Gnus is never really in plugged or unplugged state. Rather, it applies that state to each server individually. This means that some servers can be plugged while others can be unplugged. Additionally, some servers can be ignored by the Agent altogether (which means that they're kinda like plugged always).
So when you unplug the Agent and then wonder why is Gnus opening a connection to the Net, the next step to do is to look whether all servers are agentized. If there is an unagentized server, you found the culprit.
Another thing is the offline state. Sometimes, servers aren't reachable. When Gnus notices this, it asks you whether you want the server to be switched to offline state. If you say yes, then the server will behave somewhat as if it was unplugged, except that Gnus will ask you whether you want to switch it back online again.
Let's take a typical Gnus session using the Agent.
gnus-unplugged. This brings up the Gnus Agent in a disconnected state. You can read all the news that you have already fetched while in this mode.
Here are some things you should do the first time (or so) that you use the Agent.
Both topic parameters (see Topic Parameters) and agent categories (see Agent Categories) provide for setting a policy that applies to multiple groups. Which you use is entirely up to you. Topic parameters do override categories so, if you mix the two, you'll have to take that into account. If you have a few groups that deviate from your policy, you can use group parameters (see Group Parameters) to configure them.