How to coect clients to INTERNAL WSUS server but download the approved updates from Microsoft?

I have client-side targeting setup to handle some remote workstations on our network. They VPN in from time to time -- so they can hit the inteal WSUS server when they are coected.

I essentially want to set their Windows Update configuration via GPO to use inteal WSUS, but to download the updates from the inteet (Microsoft). I'm assuming this is a very standard configuration, but my clients are still trying to download from the WSUS server. Can I control this?