If this is SEP, you should post it in the SEP forum, this is not really a SNAC question!! Answer-you need locations, and GUPs.
Branch clients will ALWAYS send logs to SEPM and receive policies from SEPM. The GUP can be used to be a local proxy cache for definition content only. In other words, you will be sending some traffic to the HO SEPM.
Remote location use LU so if they leave the office they get updates. On NW location use GUPS/SEPMs.
Better check and make sure you have sufficient content revisions kept on your SEPM as well.
You should read the Top 10 KB: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009012721190648
Suggest you post to SEP forum if this is SEP....