Question : Disable WSUS Client Update Over 3G and VPN

We have an internal WSUS Server and when users connect to the work environment over 3G/VPN we don't want the clients to download windows updates. We only want the clients to download windows updates when they are logged onto the LAN from th Internal WSUS Server. We are thinking about blocking access on the firewall to the WSUS Server on VPN but before we do this we would like to find out if there are any other method.

Answer : Disable WSUS Client Update Over 3G and VPN

Blocking it on the firewall is probably your best bet.  You could create another policy for all VPN users that doesn't install updates but allows the user to be prompted to install them at their leisure.  The VPN route would probably work better.