We currently use WSUS 3.0 SP2. One problem we have is that it doesn't handle laptops that rarely connect to VPN very well.
I know we can set up a second WSUS server that only does approvals and then configure the actual downloads to come from Microsoft. The problem with that is that the laptops will continue to download from Microsoft and waste our bandwidth even if the user brings the laptop into the office.
We also have laptops that connect to VPN so rarely that they would even miss just getting monthly update approvals.
With SCCM, we can set it up so that laptops can reach the server and get update approvals from just an Internet connection without VPN.
Does WSUS updating through SCCM allow you to to change where the updates download from on the fly based on whether the laptop is on the LAN or connected to an external network with Internet access, but no VPN access?