There actually is a way, but it's not well documented. It's the default way that we roll out our agents.
https://support.symantec.com/en_US/article.HOWTO8072.html
This still works today in version 7.6, but I believe that the filename in that document is no longer correct. We use AltirisAgentInstSvc.exe with the following syntax:
AltirisAgentInstSvc.exe -u "https://NSSERVERNAME/Altiris/NS/NSCap/Bin/Win32/X86/NS Client Package/aexnsc.exe" -s NSSERVERNAME -w https://NSSERVERNAME/Altiris -nostartmenu
We put it in a share on the NS that gets used in a system startup GPO. I could use the nscap share, I guess, but we always just copied it out to it's own share for use in the script. You'll find the file in \NSCap\bin\Win32\X86.