For endpoints that are outside of the normal network where the EMSS Server is accessible, we would recommend using a VPN connection to allow the endpoints (and thereby EMSS Agent) to have access to the internal network. The agents can then check in and get Patch Deployments.
Is it possible to enable windows update for patching on endpoint outside network over the internet directly?What will be the impact ?
You can manage endpoints over the internet or intranet with Ivanti Endpoint Security. Attached document describes how to manage your endpoints over the internet using Ivanti Endpoint Security.
Hope this helps.