SEPM 12.1.2 with Clients in DMZ Zone

We have several SEP clients in a DMZ zone - public facing - our firewall group have given us the notification that our internal SEPM cannot communicate with the clients int he external DMZ.  We have 2 firewalls   internal | DMZ1 | DMZ2  to get through.

They want to see a "relay" (I'm thinking group update provider??) in DMZ1 to distribute updates via our internal SEPM.  Does the GUP provide the status of the clients it manages to the internal SEPM or is it for ONLY providing content updates?

Thank you