How do signature updates work?

If we set up a SEPM server and deploy clients from that server, aren't all clients required to go directly to the server to pick up the updates?  We only want the SEPM server going to the Internet to pick up updates and have the clients connect to it for their updates, but it appears that a lot of our clients are going directly to the Internet.  We want to stop this behaviour.  How do we do this?

Thanks

Dan