In our case with 20 sites that requires SEPM in each site to Update SEP clients to new version of SEP clients. I do not wish to push over the WAN to all clients from SEPM (bandwidth limitation).
I do not have SEPM on each site, this would be an administrative nightmare. We have SEPM in some sites and GUPs at each site. And deploy SEP clients using other ways (external package, etc.)
My recommendation is Allow GUP’s to Update SEP clients to new version of SEP clients, so each site will update the local clients. No over the WAN client’s updates. This will reduce administration efforts. Downstream clients updates
You can also offer SEPM Integrate client (right click of a client tools) command to reinstall client option, for repair client from GUP or Auto repair option from GUPs.