Windows Update - "download content from Microsoft Updates" in deployment

[BryanP]

I've got a lot more home based users coming in over VPN these days.  Our VPN group wants to make sure that anyone connecting has all their updates.  The problem is, our environment is ... slow.  For users in the office it's not a problem.  Updates are downloading in the background, they install when they're done.  For people having their update compliance checked in the VPN client, this is a problem as they can't work until updates download and install. 

I could set up internet based client management by putting an MP/DP in the DMZ, but the networking group would rather the users disconnect and get their updates from Microsoft if possible rather than use our bandwidth. 

After reading this is page I was thinking about turning his problem into my solution, but I'm wondering if anyone else here has tried it? 

https://sccmcanuck.wordpress.com/2017/05/25/sccm-software-updates-a-lesson-in-humility/

If I'm reading this correctly, I should be able to do the following:

1. Create a collection of the machines that need to pass the compliance check.
2. Exclude that collection from my regular update deployment.
3. Create a separate update deployment to them with the option checked for "If software updates are not available on distribution point in current, neighbor, or site boundary groups, download content from Microsoft Updates."
4. Have the networking people set their VPN compliance check so that it disconnects them from the VPN if they aren't compliant.

If I'm understanding the setting correctly, the client should go straight to Microsoft and download updates, even though it doesn't have access to a management point?  Is that correct?

Yes, I could just set it up and test it, but I'm hoping someone else has already gone through this.  If