Hey,
No the fix comes from the configuration in Onguard Settings => Policy Manager Zones.
You just need to put the IP scope where you want the auto update to occur.
For the IP scope you don't want the Auto Update of Onguard, just don't put this IP scope in the Policy Manager Zones.
At least, that what the TAC told me
Regards.