Control Client communicate direct to SEPM Manager

Im controlling entire APAC where Singapore is the main Data Center where the SEPM Manager is located . Rest of the country is APAC is install with GUP Server . The communication will be between GUP Server and SEPM to get the definition update where the client will get the update from the GUP .

But There are certain client which able to communicate direct to SEPM Manager . Although policy has been assigned and firewall has been implemented . i unable to control the client by communicating . Please advice