We had the same problem. Its because (we think) the autoupdate is triggered bij the systemuser. So its use the SYSTEM account. When you do it manually it use the account thats logged in.
How we solved this:
We use a proxy to acces the internet. So we let all traffic from our SEPMserver to "*.symantec.com" through our proxy without user authentication.
this solved it. Offcourse we still need to point to our proxy in our configuration.
If you don't use any proxy authentication, then this will not help you i think.