On the Endpoint Protection > Web Control > Advanced tab you can select Scan traffic on both gateway and endpoint. You can also configure what action Endpoint Web Control should take when it encounters a site with an associated quota.
Endpoint Traffic Setting
By default, Sophos UTM does not scan web traffic for endpoints that have Web Control enabled. If this option is selected, both the endpoint and Sophos UTM will filter web traffic.
Endpoint Quota Action
Sophos Endpoint Web Control cannot enforce time quotas. Select an alternate action for the endpoint for sites that have an associated quota.
Note – The endpoint setting gets precedence. For instance, if a user has Endpoint Web Control enabled, Scan traffic on both gateway and endpoint is selected, and you have configured the Endpoint quota action to Warn, the user would first get a warning. If they proceed to the site, quota time usage for that site would then be in effect. If the Endpoint quota action is set to Block, the user will be blocked, even if they have available quota time for that site.