Following this apple KB
http://support.apple.com/kb/HT3765
Works fine. The problem comes when you delete an update from the master. The slaves will delete the update and show the correct list of enabled updates, but the cataloge being served to the users will still have the info of the deleted update so clients connected to it will be served the update and reports the wrong number of enabled updates!!!
To rebuild the catalogues goto /var/db/swupd/html/content/catalogs/others/ and clear it out. Then run swupd_sync by touching a file in /var/spool/sync . This will rebuild the catalog files.
Yet another bug in 10.7 server. However have a look at swupd_sync -h as it can do nice things :)