WFC works like this. Upon first execution of a program, the outbound firewall alert is generated after the program has been blocked. Even though you select "Allow this Program," you sometimes have to close the program (your antivirus) and re-launch it.
You can enable Learning mode, launch the program, close the program, then re-launch the program.
Do this for both automatic and manual signature updates.
You can also enable the Shell Context menu for WFC, navigate to the AV signature updater process, right-click, and select "Allow this Program."
Finally, you can view the connections log, find the blocked AV, then right-click and create an Allow rule for it.
Windows Firewall Control does not create suspended firewall rules.
Read the manual. It's a bit unclear, but that is how the product works.