It is better to create a separate group for that .Then you create a non shared liveupdate policy for that group in that policy you can specify that it can use symantec live update for updation and you may also allow the user to launch the liveupdate... 

I have this working and you dont need to use different groups.  I used location awarness and have the on domain location or off domain location being determined by if it can see the sepm console.    If it can see the console then I have a update policy that has it pulling updates from he console or gups.   The off domain policy is set to check once an hour for updates from symantec.

To set up the location awarness under the clients tab   look under tasks and click on add location  you can choose many options there to set your what do detect for your location.  After that you can assign which update policy you want for which location.    Works very well.
 

Rick

Thats sounds great - thanks for the reply.

Prachand - Thanks as usual!