The ATP's Active Endpoints count is showing a different number of clients than the SEPM's Total Endpoints count.
The Active Endpoint count is the number of managed Symantec Endpoint Protection endpoints that incurred any type of event activity within the last 96 hours (4 days). This activity may be suspicious, malicious, or benign.
As the Active Managed Endpoint total represents only those endpoints with recent activity, you must refer to your Symantec Endpoint Protection Manager for a total of all endpoints, which uses a different set of criteria.
There is no expectation that the Active Endpoints count in ATP will match the SEPM Total Endpoints count.