Although Restrictions are allowing for traffic, I believe this has more to do with the way we filter categories.
If you could advise me what device she was using and approximately what time she tries to update, I'll be able to check our logs and see if this is the case. 'Required Web' is one of the categories assigned to Apple updates, so this would need to be allowed during the time she wishes to update. If the device is trying to update during sleep time, it won't be allowed.
Looking forward to hearing from you soon.