Blocking clients from being added to groups
http://www.symantec.com/business/support/index?page=content&id=HOWTO54730
Blocked Live Update Setting
SBE there is no option to set settings.
However if you want you can disable the Liveupdate option at the Client side by changing the following registry.
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\
and chnage the values for "AllowManualLiveUpdate" to 0.
This can be done from the GPO so that it can be applied to all the clients