@calum_carey][/url
Yes, but only if you had an externally facing JSS of some kind, such as a cluster with a Limited Access JSS. Then you could use an "internet" Network Segment that would encompass anyone not on one of your internally defined Network Segments to get the SUS settings reset using command @bentoms][/url posted above. If the JSS is only accessible from inside the network, then there wouldn't be a way to drop external clients into the "internet" network segment and thus no way to run a policy on them to remove the SUS settings.
@a.simmons][/url
Is controlling the updates clients see important to you at all, or do you not care if they can install anything they want? If its not important, and you do have an external JSS, then you could do what was outlined above and that should help. If you do want to control the updates, or, you don't have a JSS in the DMZ, then you'll have to look at other solutions.
Awhile back we had looked at solving the same problem as you, and although I came up with a possible solution, we never implemented it, because we're looking to eventually go a different route.
But what I came up with was, instead of using an Apple SUS, using the JAMF NetSUS appliance and some scripting work.
One of the features of NetSUS, which comes from the underlying Reposado code it uses, is the ability to control the Update catalog, but still have the updates themselves come from Apple's servers. Kind of best of both worlds in a sense in that. you can still disable certain updates if that's important to do, but you don't need to worry about hosting the actual updates in-house. You lose some of the speed of updating since its pulling the files from Apple, so its a little bit of a compromise to address the issue of clients away from the network.
The trick to actually getting the clients to be able to use Software Update while not on the internal network is to curl down the CatalogURL from the NetSUS appliance into a file located on their Macs, and then script it to point Software Update to use that local file as the CatalogURL.
If you're interested, I could run through the basics of how I had it working.
