stop internet access to the sep client which having old virus definition

HI,

I want to stop internet access to those sep client which are having old virus definition. Endpoint Manager will allow internet access to those SEP client only after checkig the virus definition .....

can I setup this kind of policy from Endpint Manager ?

Please recommend if any additional firewall (like: Check point firewall) is required in this case ??