Real-world best practices for GUPs when SEPM is AD-integrated

See my original question here.

Questions:

1. I am reading conflicting information on SEPM with Active Directory integrated and using GUPs, would like real-world best practices. SEPM is at primary site. SOHO count is under 10. All WAN traffic comes back to primary site. SEPM needs to pull down updates, then spread to GUPs. Clients should communicate with GUP in their subnet before contacting SEPM for updates.
2. Need some help, again real-world best practices/experience, on setting up GUP at each SOHO and verifying (currently GUP=False).
3. Conflicting information says to use GUPs with aforementioned config, SEPM should be changed to groups, not AD-integrated.
4. If SEPM is changed to groups (no more AD-integration), what verification method would be recommended so that hosts are protected... don't want an infection because someone forgot to load SEP client.
5. Additional questions... ad infinitum.