They don't have to necessarily match. The count in ATP only shows those clients with some sort of activity of a 96 hour time period. See here:
http://www.symantec.com/docs/TECH236139
It seems reputation data was being counted which caused the endpoint count to rise and be misleading. This recently changed and now the endpoint count should accurately reflect clients with real, actionable, info.