Essentially I was wondering if it's possible to use the local gpedit.msc on Windows 7 and Windows Server 2008R2 machines to configure clients to use a workgroup based WSUS installation. With this - I would still like to ensure users can use Windows Update manually but the WSUS does the majority of the work!
Please see the article Configure Automatic Updates in a Non–Active Directory Environment.
This should be enough to tell the system to use your local WSUS installation.
Please see the article linked above for further options in configuring the Windows Update behavior.
These are the default settings a Windows Small Business Server 2010 will set:
It should also be noted that these settings are also accessible through the Local Group Policy Editor under
In the group policy editor, we can also see the group policy that may be used to restrict access to Windows Update for a user. This would allow installation only directly through WSUS approval and automatic installation (which would have to be configured):