Hi,

We would like to update our Endpoint Definitions with a one week-lag.
I.e. the clients in our environment should never download definitions that were just released.
Instead every definition update should be quarantined for one week, where we can perform tests in a non-production environment to be 100% sure that it does not impact our systems negatively.

What is the easiest way to accomplish this? We are running Windows 7 and SCCM 2012 R2. 

You should first configure SCEP NOT to download and install update automatically and only do it for one or few machines which you do testing. Once everything was fine, then you could do manual deployment every week.

Or you could only add share folder as resource to deploy update and disable other sources and once you tested, download the latest definition from Microsoft Malware Protection Center and put it inside the share folder.

For more information about updating definition, take a look at:

https://technet.microsoft.com/en-us/library/jj822983.aspx

Just I am wondering why you want to delay downloading definition? It is not recommended and might put your PCs at risk. If you are facing any compatibility issues with definition update and your programs, you may add those programs to exception list instead.