Not an ideal solution but, you can turn off the san altogether that is initiated by Symantec.
Create a Schedules Task that would run on the machines, ensuring proper intervals without the need of having multiple servers in multiple groups. It would allow for the distribution of updates to all servers in the same way.
Only problem would be running the Task, as you say, at pre-determined times...
I know it's not ideal, but maybe a possible work-around in the interim....