The simpliest mode is by configuring GPO to target the site the user is in currently. As we know user can move, so that way the server the user will use will be always the nearest for him.
At your head office you use a WSUS server for downloading the patch and approval, and in other site, where needed, you use WSUS server in replica mode.
To have that work in Active Directory and Site make sure all your site are configured. After that you link the correct server by site. See there for an example