We push it out to our machines through the sophos console, works spot on, especially if the machines are in AD, saying that we have used the same method for years, before we had AD pushing out to workgroup computers.
Should be quite simple, sophos have great support too if you have any probs.