Customer needs to have a security profile that prevents the devices that are connected to the "nvlan" virtual lan from getting batch job updates. The devices on the vlan would then need to be updated during the normal work day while they are authenticated or they would become out of rev with supported software both custom code and Microsoft updates.
With the use of UPM Timers and two custom CLI Scripts we were able to facilitate this process. The UPM timers basically start the vlan modifications needed to move the ports from the protected vlan to the vlan where the can be authenticated and updated. The scripts themselves and timer documentation can be found on The Source as a PDF posted by William K. Lee. If you do not have access to the source contact me at my Extreme E-mail and I would be happy to send you the document.