SEP client need to report to SEPM but live update need to be done only from internet

Dear Support,

One of our client requirement need to be fulfiled with this requirement mentioned bellow.

SEP client systems will be in someother location outside INDIA and those client systems need to report to SEPM server available in INDIA we have firewall configured in both location configured with tunneling systems will be reported through that but the challenge is live update need to be done only from internet not from SEPM server, Please give me the best configuration to configure and perform the activity.