You configure the LiveUpdate policy as shown below, but the SEP client downloads virus definition from the LiveUpdate server even when "LiveUpdate runs only if Virus and Spyware definitions are older than:" condition is not met.
In Server Settings both options are checked:
In Schedule tab, at the bottom, both options under "Options for Skipping LiveUpdate" are checked:
This issue is fixed in Symantec Endpoint Protection 14.2 RU2 and later. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec software.