Hi
the Endpoint Protection should have a firewall and should be able to block Maschines Traffic, if the Virus definitions to old. Only the Local network should work, but no access to the internet, except the definition update.
For locating the local (home network) to have access in this time to your file server (this is very importend in the login process in windows) the astaro should have a group with home gateways and in this group you should be able to put every ,,home gateway". This can be every gateway in every location of your company - normaly with the MAC of the internal NIC. For now we don't have a MAC based Network object, but for the firewall and the Sophos firewall explicite its very important to identify the local lan with MAC or/and local DNS Servers.
kind regards