WSUS Clients installing unapproved updates

This is an odd one,

We have a WSUS server configured to tell clients through a GPO to check in for windows updates and download them from Microsoft Update (so we don't have to have a WSUS repository taking up space). Previously we did have a WSUS repository and the same issue occured.

While on the domain the client laptop behaves perfectly well, only ever updates if WSUS updates are approved for it's Computer Group in WSUS.

However... if I have that laptop on the domain for say 7 days, has several reboots and NO WSUS updates are applied, when it is taken home by the user, it is put in "sleep" and when it starts back up is logged in as the domain user, if the user connects to the internet to login to our network via the VPN, it starts downloading windows updates it doesn't have, that have NOT been approved by WSUS.

Why would this be, and how can I stop it from updating when it's "off" the domain network but connected to the internet?

Has anyone experienced anything similar? So to re-cap, Windows Updates behave as expected on the domain network, when on any non-domain network connection the laptop installs updates it shouldn't

Thanks

Dougie