SEP will use a GUP, which means one machine is designated to hand out updates to clients on a LAN instead of coming back to the SEPM for updates. However, it won't block this. Have you disabled the SEP firewall to see what happens? Are you even using a GUP?