For initial testing we just download the installer from the McAfee site and manually install HIPS on a few machines. That is probably the safest way. Although I am hopeful that with the release of McAfee Agent 4.5.1 that we will be able to "push out" patches from the Evaluation branch in EPO. This would allow for a more controlled testing roll out.
Make sure you have Global Updating disabled first. Refer to the ePO product guide to understand the configuration.
If global updating is enabled, distributed repositories update managed systems automatically,
as soon as selected updates and packages are checked in to the master repository. Update
tasks are not necessary. However, you do need to be running SuperAgents in your environment
if you want automatic updating. You must still create and configure repositories and the update
If distributed repositories are set up to replicate only selected packages, your newly
checked-in package is replicated by default. To avoid replicating a newly checked-in package,
deselect it from each distributed repository or disable the replication task before checking in
the package. For additional information, see Avoiding replication of selected packages and
Disabling replication of selected packages.