EP webprotecton profile OR Network webprotection profile

Dears,
I am asking about the URL-filtering in both EP and UTM, if I have my EP reside in a network behind and protected by the UTM,
Then I allow for example social networking in the EP profile but disallow it in a profile assigned to the network where the EP reside.
Which profile will have the last word, EP profile or network profile?
What I experienced is that the network profile has the last word always "and this disagree with what sophos mentioned.
So if I allow social networking in EP profile and disallow it in network profile , the result is that the social networking is disallowed.
And when I disallow social networking in EP profile and allow it in the network profile , the result is that the social networking is allowed.
I changed the order of my profiles so the network profile is in the bottom, but this did not change the above result.
Please note that the EP profile working fine when the EP is outside the private network.
I am asking about any ideas about troubleshooting this issue.
Thanks,
Mostafa Aly