Is a a known feature of SEP. If you have any Firewall Policy applied for applications it will allow the applications but once the application has changed ( updated ) the hash changes so again it will ask you whether you want to allow it or not.
Do you have set the firewall policy in ASK mode?
or are these clients in Client Mode