How to allow External Live Update Server when users are out of corporate network

Hi,

I have the following setup for one of my customer.

There are 7 sites which are connected to Datacenter and the SEPM is installed in here.

There is a seperate group created in SEPM for each site and a seperate Live Update Policy applied to enable all the clients to take updates from a local available GUP.

Everything works fine.

Now i am concerned with the roaming users, lets say user1 from site1 where there is a GUP policy goes out of the network and works over internet.

How will this user get Virus Defintion Updates? because as per the Live Update Policy the client check for the update from the GUP if it doesnt find the GUP does it go to Internet Directly?

Please suggest.