SESC uses RMS as communication system, all other use MCS and you can't have both on the same endpoint. You can either add Exploit Prevention to the on-premise SESC (includes Exploit Prevention, CryptoGuard, Clean but not Lockdown and Heartbeat) or go for Central.
