You could also execute the signature update when the local defs are over x days old so not need worry about the full MPAM and the complications of that being updated by MS 3 times a day. Unfortunately its a WMI based inspection but if the definition age is either -1 (indicates no defs are is use) or > 3 then the the endpoint is relevant ro un th update command.