Separate the policy for secgroup update

We need to disable it as it would break cell syncing.

Change-Id: I695469d77e74997806bf2f336740c12dc7f8cb82