A customer had installed SCCM 2012 and uses it for End Point Protection only for now.
This is the same whether you have ten clients over the remote WAN link or two hundred.
For sites with a very small number of clients, it is unlikely that a GUP would be needed.
Running the SDEC is a labor intensive operation for the WUAHandler and Software Updates agent on the client, requires a full sync of the WSUS info, which puts additional load on the WSUS server.
You need to enable Microsoft Update, so that the system will be able to install updates for products other than the core Windows operating system, which includes Endpoint Protection.
The instructions below are for Windows 8.1 and Server 2012R2, however similar instructions apply to Windows 8 and Windows 7.