In the end, I thought about what was important to me here... and that was hosting the SUS internally so clients don't have to reach out to download content when it's local. While being able to test the patches first is also very important, since I cannot get the SUS to behave the way I want and having repeatedly disabled patches (note: 10.11.3 Update & Combo Update would get disabled! That's a big deal to me.), and facing the prospect of not using the SUS at all and have client download the content without testing anyway... I endeavored to try and get this to work.
And in the end, it's working.
Forgive me, because I tried MANY time to reset this so I could make it work the way I wanted and it would always end up in varying states of failure, so I finally settled on something that appears to be working, I will try and retell the steps I took. Some of the steps are possibly pointless, but I did them out of desperation and some voodoo.
This was on a vanilla re-image of OS X 10.11.3 with Server 5.015.
I turned off SUS in the Server.app.
I rebooted the server. (Pointless?)
I removed the "Software Update" directory and all t's content from /Library/Server/.
I rebooted the server. (Pointless?)
I opened Server.app chose "Automatic" to download & enable content (this PAINS me still).
I quit Server.app. (Pointless?)
I opened Terminal and did "sudo swupd_syncd" and let it do it's thing.
All content was downloaded, mirrored, and enabled for my institution going on..... 8 days now?
[A note about the "Pointless?" from above. I've no evidence that these steps are useful in any way, however, given the issues that I'd had trying to get the SUS to work, I felt the need to get a little medieval with my approach to nuking the SUS, making SURE it was nuked, and starting over.]