Client Machines directly hitting internet for Symantec updates

Hi,

We have around 3000 computers installed with 12.1 managed sep client and one SEPM server. It is found that the machines are seen contacing directly to the interent for downloading updates instead of only contacing sepm server. The hit is to the url ent-shasta-rrs.symantec.com:443  and is very high that the complete bandwidth is getting chocked up. Please help how we can avoid such hits to our proxy server.

Regards,

Anishk