It doesn't seem to be documented anywhere on Microsoft's site but Microsoft Security Essentials uses the Windows Update service to perform its own updates, if the Windows firewall is used it is possible to allow the Windows Update service to access the internet even though it is just one of the services hosted by a single instance of svchost.exe.
It is still possible to uses a local WSUS server with MSE updating from Microsoft without any issues.
On the whole MSE has my PC booting much quicker than it ever did with AVG so I'm happy, if only it had been more obvious why it couldn't update.
