We're debating the upgrade to 12.1.5 but in the meantime is it possible to get updates/rollups for 12.1.3? The SEP server does not have internet access so I would have to download and install the update manually.

Yes, no issues. 12.1 will manage and update any and all versions of 12. 1. Assuming you're familar with this but adding these articles as a reference:

Downloading LiveUpdate content manually to Symantec Endpoint Protection Manager

Download .jdb files to update definitions for Endpoint Protection Manager

You will be downloading the JDB and appying it manually

Download .jdb files to update definitions for Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH102607

Yes you can able to manage all the low version client from latest SEPM.

You can install the .jdb file in server incomng folder. So it will produce it on all the sep client

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=sep

Download .jdb files to update definitions for managed Endpoint Protection clients

Yes, it's possible. Symantec recommends to keep the SEPM and SEP clients on the same version & always use the latest version to enjoy new enhancements and next level protection.

Here is the latest best practice article for SEP 12.1 RU5 (12.1.5337.5000)

Best practices for upgrading or migrating to Symantec Endpoint Protection 12.1.5 (RU5)

http://www.symantec.com/docs/TECH224034

Yes. You can use .JDB to update the sepm. And depending upon the policies, the clients will download the updates form SEPM. You can update the JDB once/twice a day.

Best practices for upgrading or migrating to Symantec Endpoint Protection 12.1.5 (RU5)

http://www.symantec.com/docs/TECH224034