If client is using an MSL (Management Server List) with names that require resolution to IP addresses, the SEP Mac client won't honor firewall rules if it can't use this MSL to successfully connect to SEPM. If the MSL uses IP addresses only, the SEP Mac client will continue to honor firewall rules even if it can't connect to SEPM.
Currently under investigation
SEP for Mac, release : 14.3 MP1
Our Engineering team is investigating this issue and will update this document when a solution becomes available.