If the client is not able to download the definition from the GUP due to the amount of time it takes or if the GUP is unavailable, it will then default to pulling definitions from the SEPM.
In some environments client communication will go over the WAN while Internet traffic will traverse through a cheaper local ISP.
In this scenario one serious discussion should be if it is better engineered to have all clients retrieve their definitions directly through the Internet to Symantec’s public Live Update servers.
We have run into scenarios where SEP administrators have configured remote client desktops as GUPs.
A few months later it was discovered that these systems have been decommissioned and replaced.
On a subnet over a WAN link, you would have a single client retrieving definitions from the SEPM.