Hi Guys , 

If this has been answered, please forgive me and direct me to that. i have multiple sites wsus installed (sites are connected via vpn). at the moment each sites has it own servers of wsus and in GP ,sites OU to report to its own server. What I like to do is have one master at one site and approve the updates at that server. clients download the updates from it own servers. not from other sites. then again that servers on the branch offices will download updates from Microsoft rather than Master server to save the vpn bandwidth. 

how can i approach that 

thanks

You can set up WSUS hierarchy with a root server and a number of downstream replica servers. In this scenario, updates are approved on the root server and information is replicated down to replica servers. WSYS can also be configured to synchronize metadata only and let clients fetch content for approved updates directly from windows update site, so that you can avoid additional load on inter-site links.

Take a look at the following articles for more information:

Design the WSUS Server Layout

Design a WSUS Storage Strategy