Endpoint Protection

Two situations:

1. We have a number of remote users who do not regularly plug into the office LAN.  We would like to configure SEP/SEPM to have their notebooks check in with the SEPM server over the WAN (not a VPN connection) to update policy, definitions, etc.

2. We have a couple remote offices that we would like to essentially configure the same, except that we I guess we would configure a GUP onsite to update the other workstations.

Does anybody have some suggestions as to how we can do this, without using a VPN?  Thanks for your help.

How would the user's connect first?

So, Your SEPM is going to be on a terminal server with a public IP.  You can use SNAC portion to validate the policies, definitions etc, But the way it's going to be setp will be too insecure for a corporate.