Software Update Scan Cycle automatically changes the WUServer value

Question

We have 2 forests, Forest A and Forest B that are untrusted. We have a Primary Site installed on Server A in Forest A with a Software Update Point. 
We got the Software Update Point Role installed successfully on a server B in Forest B (its a Replica of Upstream server) by opening the firewalls between Server A & Server B. WSUS Sync is working fine between Server A & Server B, no errors in the logs.
We are now trying to patch the clients in Forest B, every time we run a Software Update Scan Cycle on the clients, the Windows Update Server setting in the Local Policy (Specify intranet Microsoft Update Service Location) changes the value from http://serverB:80
to http://serverA:80. Since the firewall rules are blocked between clients in Forest B to site Server in Forest A, the patching fails with the following error - "OnSearchComplete - Failed to end search job. Error = 0x80072ee2."
Manually changing the value in Local Policy to http://serverB:80 does not work, on the next scan cycle, this gets changed to http://serverA:80 automatically.
We tried to set a Domain GPO to avoid changing the value, but that results in a different failure - "Group policy settings were overwritten by a higher authority (Domain Controller) to: Server http://ServerB:80 and Policy ENABLED Failed to Add Update Source
for WUAgent of type (2) and id Error = 0x87d00692."
It looks like a bug where the client is trying to auto assign the primary site server as a WSUS Server Location. If the client needs to access the Server A directly for a Scan cycle, what's the point in installing Software Update Point in Forest B? From a security
standpoint, this absolutely does not make any sense. Any ideas what might be happening?

Answer 1

Thank you Jason!
I think I was a little unclear.. the SUP that I installed in Forest B is a replica of the SUP installed on Primary Site (Forest A). You're right, both the SUP's are syncing without issues. (The Upstream server that I mentioned above is the one on Primary
Site)
We do have a MP & DP on the server B (Forest B) that has a replica SUP, and all the client communication is restricted to Server B (Forest B) for Software distribution, Policy assignments, PXE. Could you tell me the purpose of the client to directly
talk to SUP in a different forest when there's already a SUP within the same forest (even though it's a replica).