block Windows Update using either SEP 12.1 application Control or Altiris application blocking

Hi

Altiris CMS 7.1 SP2 exist and utilizing the Patch Management fetaures. In this case, I want all workstation especially those who have internet access (mostly mobile devices) to refrain from downloading updates directly from Microsoft. I wonder if this is possible using SEP Application Control or Altiris application blacklisting.

I used to think that I can block the traffic using personal firewall however my SEP client dont have firewall components. AD group policy is my last resort. Still, As much as possible I want to do it using SEP or Altiris.

Appreciate any ideas and suggestions

Thank you in advance