I know the best route is to update to the latest / greatest SEP 12.  But is it true that any variation of SEP 11 is no longer supported, no longer will get defination updates?

If so, another question:  we have different versions of SEP 11 on  clients, but not all of them have stopped updating at the same date, some are still updating, this doesn't make sense?

That's correct. As of Jan 5th, 2015, SEP 11.x no longer receives updates. See these links:

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-110x-eosl

https://www-secure.symantec.com/connect/blogs/did-you-get-security-memo-symantec-endpoint-protection-11-eosl

The one caveat is if SE11.x clients are connected to a 12.1 they may possibly receive untested definitions...

Best route is to upgrade to 12.1 as soon as you can.

Yes. SEP 11.x support is over and no direct definition is release for the clients. SEP 11 clients may receive untested definitions via the 12.1 SEPM for a few additional months. However, they will not be available via LiveUpdate or SEPM 11 and should be considered a last resort while completing migration.

I suggest you to upgrade the SEP client and manager in 12.1.5, as it is latest version apart there is some modification is version.

11.x support is close so the new virus will be effect on it s fast and upgrade.

Upgrade or migrate to Symantec Endpoint Protection 12.1.5

 Article for upgrade SEPM 11.x to 12.x

http://www.symantec.com/connect/articles/sepm-11x-sepm-121-upgrade-process-graphical-overview-embedded-database

Symantec Article to guide to use the Autoupgrade Feature for upgrade the clients

How to upgrade Symantec Endpoint Protection clients by using Auto-Upgrade

Auto Upgrade still requires a restart correct?

If the upgrade includes NTP then yes. The clients will also show that they need a restart via the SEPM console.