Managing and deploying updates via Configuration Manager
On the Patch deployment download settings you have to allow clients to download update from internet,
This is not correct when a CMG is in use. Clients detected as on the Internet (and connecting via IBCM or a CMG) will always use Microsoft as the primary source location for downloading Microsoft updates.