Number one is the better option. Create a deployment task at the My Organization level in your tree, Set it to run Daily starting at 9am randomized for 8 hours. This will run every day completely randomized throughout the day. Your concern about it "running on machines that are up to date" should not be a concern. The deployment task is smart enough to do comparison on the locally installed version of AV and agent and then see whats available in your repository. If the version of the product in the repo is greater then the version installed locally then it will upgrade/install the product. if the versions are equal it will do nothing. so there is no stress or download like you are thinking on the local client. in addition this is also optimal if you are concerned with endusers removing the client....if the agent finds the product is missing it will reinstall it ultimately making sure that whatever you have in the repo is what stays on the clients.