Please remember that agent installation is a special case because it is the agent that establishes communication to ePO.
All other installs have that already available, but agent installation does not, so it runs separately.
As far as client tasks are concerned, after the agent is installed it will 'phone home' to the ePO server within 10 minutes (randomised) and it will then pick up any tasks or policies assigned to the group where it is added in the system tree.
If you have a 'run immediately' installation task set for that group it would be picked up and as it suggests would immediately initiate a virusscan installation on the client.
Run immediately tasks only run once for a client (unless reset or modified) so this would provide the first-time install hit you might looking for.
If VirusScan is found to be installed already it is not reinstalled, the only thing that happens is the current status of VirusScan is sent back as an event (Typically less than 1k). Local script checks by the agent make sure of that. The impact on bandwidth is therefore small. Deployment tasks of VirusScan that are successful will follow-up with a content update (autoupdate) check so that dats are also updated as soon as possible.
You may find this useful:
(ePolicy Orchestrator 4.6 Hardware Sizing and Bandwidth Usage Guide)
If you want a one-hit installation, look up 'McAfee Installation Designer', as you may be able to bundle up your own custom package using it.
Thank you for a terrific explanation.
with best regards,