Scanning PC before full network access

I have a scenario where I have Symantec Endpoint Protection (12.1) on all my PC's/laptops but would like to have a system that would scan any system that has been off the network for say 7 days etc before its allowed full network access.

Idea being that if someone was working away offline and had picked something nasty up for a USB etc when it next touches the network a full scan would be started and the system held in some sort of container until the scan was complete.

Im not sure such a practice is supported by SEPM but thought I would ask.

Thanks