That's correct.
Once the SEPM updates at 08:00, all clients will then update in accordance with their heartbeat settings and download randomisation windows (via the SEPM or via a GUP as appropriate). Updated clients will not update again until the SEPM gets another set of new defs (at 20:00), but you still cannot stop a subset of clients from updating between certain hours (not wihout messing around with LiveUpdate Content policies anyway, which would entail a lot of daily administrative effort).
To be fair, the idea of GUPs is to reduce the amount of data sent over WAN links so that you don't have to manage timings. If you're still experienceing bandwidth utilisation issues, then you may wish to look into using LiveUpdate (to tell the clients to update from either Symantec or a LUA), on which you can set a specific schedule per group.