Yes, you can configure two different location, one for off the network and one for on the network and assign two separate policies. You would create one LiveUpdate policy and set it for clients to get updates from Symantec and assign it to the Off Network location and than create another LiveUpdate policy which defines the GUP and assign to the On Network location

Best Practices for Symantec Endpoint Protection Location Awareness

Using location awareness with groups

How To Optimize Endpoint Protection for Branch Offices using GUPs, Load Balancing, and Location Awareness

also do check the explicit GUP feature with SEP 12.1 RU2.

http://www.symantec.com/business/support/index?page=content&id=TECH198640

To be fair, as we're mentioning GUPs, you may not need go to so much trouble.

The multiple GUP feature allows you to define a long list of GUPs which is passed onto SEP clients.  Using this feature, the SEP Clients then take this list, determine if it is in the same subnet as any of the GUPs, and use one if so.

This is best used if you are able to find a machine to act as a GUP in each of your subnets, but negates the requirement to use Location Awareness.  As the logic is performed by the SEP Clients, this is generally easier to implement.

There aren't really any risks to using GUPs per se as it is just a proxy cache for defs, but you do need to consider what SEP clients should do if a GUP fails (i.e. should they not update at all, use a 'backup' GUP, or go straight to the SEPM?).

I'd recommend reading up ont he below article on GUP best practices:

http://www.symantec.com/docs/TECH93813

http://www.symantec.com/docs/TECH95353

If you're still interested in Location Awareness, the Brian's links should sort you out.

Further to the above post, this article describes the GUP logic:

http://www.symantec.com/docs/TECH198702