I'm self answering this, but if anyone has any followup info or corrections, please let me know.
Apparently, McAfee creates an executable on the fly called "mcscript_inuse.exe". Allowing that process to have outbound connectivity allowed the update to successfully run. The problem I had in troubleshooting was that Windows 7 firewall does not log blocked outbound connections. And, when trying to create a rule, that file didn't exist so it couldn't be selected.
Just to follow up on this - in Windows 7 x64 the path to mcscript_inuse.exe is "%ProgramFiles% (x86)\McAfee\Common Framework\McScript_InUse.exe". I'd imagine that the path should be the same for 32-bit minus the "(x86)". I'll give it a try on our 2008 R2 boxes to see if it behaves the same way - I know a few other posts were pointing to this one (that's how I found the question..... and an answer!!! )
It seems to work for me, but as I had updated VSE earlier in the day prior to enabling the firewall, I'm not sure if other processes are involved in fetching the updates.
Hope this helps.