Updating the definitions will never require password. Only occurences to trigger the password protection on SEP client would be:
- to open client user interface
- to stop the client service
- to import or export policy
- to uninstall the client
Have a look which of these options are selected for your clients - you will find in the General Settings -> Security Settings for the affected group of clients.