When adding a domain to the Deny list in the UI of Endpoint Detection and Response (EDR) appliance, SEP clients do not block connections to the URL with their software firewall feature.
This is not a feature of EDR appliance. Domain names entered in the Deny list are effective for the network scanning component. These entries are not passed to SEP clients in the form of a firewall policy.
Behavior by design.
Title: EDR 4.6 Help - How Symantec EDR applies deny list policies based on your operating mode