Remiediate Antivirus on devices that fail APM AV policy check

I am implementing APM for external device connections one of the checks is Antivirus. If the device is a corporate device I want to automate the updating of the antivirus files as much as is possible. The denominator between Corp and BYOD is a certificate. If a cert is identified can the device be directed to an Web server service on an internal (or DMZ) AV server that will provide a link to click to start the updates or start an exe/msi/pkg to push the files???

If the device is not corporate then they will be directed to a web page that explains that they have to fix it them selves :).