Per ThatDude, create Startup Scripts in GPOs linked to the AD Sites that correspond to your subnets (...assuming, here, that AD Site boundaries map to SEPM Group boundaries). Use this technique:

https://www-secure.symantec.com/connect/articles/startup-scripts-and-sylinkdrop-better-together

There's a catch in your situation, though. You'll have to do it twice: Once to make the client unmanaged (drop a SYLINK.XML from the original distribution media to do so), then again to make it managed and move it to the correct Group. Once everyone's out of Default Group, you'll want to remove that part of the script to speed up boot times.

Also, modify your existing installation method to install unmanaged clients, and the Startup Script will put the client in the right Group. We've been doing that for years with SEP via GPO install, and a similar method with SAV for years before that. I've never had anything but trouble from Symantec's push installers; YMMV.

If your desired SEPM Group boundaries don't map to AD Sites, it will get more complicated. You can use Group Policy Preferences (if you have them) with IP Address Range targeting to create a Scheduled Task to run SylinkDrop with specific SYLINK.XML files. Or, assuming a straightforward subnet mask like 255.255.255.0 and single-homed machines, parse IPCONFIG output for the subnet in a batch file.

HTH