Users need access to the interface to run a LiveUpdate however, you can still lock down the client so they can't turn it off:
How to block a user's ability to disable Symantec Endpoint Protection on Clients
http://www.symantec.com/docs/TECH102822
How to block a user's ability to disable Symantec Endpoint Protection Small Business Edition on Clients
http://www.symantec.com/docs/TECH172434
How to lock down Symantec Endpoint Protection 12.1 Client
http://www.symantec.com/docs/TECH167182