Endpoint updates

It does not appear there is any way to have clients get updates from the UTM and have only the UTM get the updates from Sophos via the Internet.

Is this how UTM endpoint protection is supposed to be deployed in the Enterprise?

I was expecting this to be similar to Sophos Enterprise management where the clients can be configured to get updates from an Enterprise Sophos system.

This obviously won't scale out if 10,000+ clients all have to get updates from the Internet.

Hopefully I'm missing something :)