What version of SEPM/SEP are you on?
This issue was fixed in 12.1 RU2. See fix note here:
Client bypasses the newly promoted Group Update Provider despite policy that states it should never bypass the Group Update Provider
Fix ID: 2757957
Symptom: Clients bypass newly promoted Group Update Provider and contact Symantec Endpoint Protection Manager directly for content, even though policy states it should never bypass the Group Update Provider.
Solution: Client does not bypass the Group Update Provider if policy is set to "never bypass," even if the new Group Update Provider's guplist.xml is still empty.
New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2