Corporates / large customers don't use Microsoft's update servers, the bandwidth required would be stupid. They download the patches to a central staging server, where they can roll them out to a group of test machines, and once the testing is complete, they can roll it out to all of their machines.
All their workstations point to their internal update server.
For large organisations, this is a non-issue.
No problems on my AMD machines... Just some OEMs ignoring Microsoft's advice for 3 years...

But yeah. Hence the above, the NHS should already be using a centralised rollout.
Again, corporates have a licence server. You can firewall it, but it isn't necessary. Vista Enterprise automatically contacts the central authentication server once every few months. It was designed to stop people getting the Enterprise DVD (which doesn't require a separate key number) and using it at home, like they did with XP. The machine needs to be on the network to register the Windows install and needs to be regularly returned to the network for re-authentication (for laptops). If you stick Vista E on your home machine, somebody will probably notice you lugging your gaming rig into the office on a regular basis!
I would suggest that your ICT people get retrained on how to run a Microsoft environment!

This is basic stuff that anybody who is
planning to manage in a Windows environment should know...

Windows will have its own version of version of WGA, but it isn't as aggressive. I think for unregistered machines, it will set a permanent background image, saying that the version of Windows is not authorised...
Whether Windows 7 auto updates or not should be irrelevant for an organisation, especially something the size of the NHS...