Please let us know which format does sepm downloads the updates from symantec site so that we can unblock it in our proxy server.
.zip format
You need to allow below firewall ports
For environments with a corporate proxy, allow HTTP port 80 or FTP ports 20, 21 and port 443 connections to these hosts:
liveupdate.symantecliveupdate.com
liveupdate.symantec.com
update.symantec.com
Note that IP address obtained by DNS resolution, should not be used, as this may be subject to change due to system updates and load balancing. It is highly recommended that the provided host names are used.
Disable content caching and AV scan in the proxy for those connection to avoid corruption of the definition files