You can update Symantec client product software automatically by permitting product updates with a LiveUpdate Settings policy. When product updates are permitted, patches are installed on clients when a LiveUpdate session runs. The session can be scheduled or manually started. When the policy is configured to deny product updates, client software can be updated only manually using the Symantec Endpoint Protection Manager console.
When the Symantec Endpoint Protection Manager downloads and processes LiveUpdate updates, it creates a content delta for the group you update. The content delta automatically appears as a new package. You can then select the package and update groups and locations manually with the Upgrade Groups with Package feature.
I don't think there would be any banwdith issue. As the upadtes doesn't happen all the time.
Product Update Settings
Download product updates using LiveUpdate Downloads and installs client software updates automatically when users click LiveUpdate or when a scheduled LiveUpdate session runs. When disabled, prevents downloading and installing client software updates, even if another Symantec product runs LiveUpdate on the client computer.
If the LiveUpdate Settings policy specifies that clients download updates from a Symantec Endpoint Protection Manager or Group Update Provider, the updates are in the form of microdefs. If the LiveUpdate Settings policy specifies that clients download updates from a LiveUpdate server, the updates are in the form of MSP (patch) files.
This setting lets you control client software versions. When this setting is disabled, client software can only be manually updated with the Symantec Endpoint Protection Manager Console. When the Symantec Endpoint Protection Manager downloads and processes patches, it creates a microdef, which automatically appears as a new package. The new package appears in the Client Install Packages pane. You can then select the package, and use the Upgrade Groups with Package feature.