WSUS 3.0 Question

I have just implemented a WSUS 3.0 server and had a few questions relating
to 
Group policy more of less.  All users are administrators of their own PCs,

the GP for the domain is configured to look at the WSUS server for
updates.  
I have noticed that all users can edit their own local GP policy, if they 
disable the option in their own local GP will it effect what the domain GP
is 
set to?  Also I notice that my users are able to go to the Windows update 
website and get updates, like XP sp3, that I didnt approve on the WSUS 
server?  Can i disable users from going to the update site?  Or is there a

setting I am missing.  I am brand new to WSUS so be gentle.

Thanks.