From what I recall, in a non-domain environment, is that Windows will try to send its credentials along first and if they match, it will let you in to the share, if not, then brick wall.
Here is an example: (Even though all my PCs are Windows 7, this should work with XP as well and 8.1 I believe.)
Media Sharing Host (Windows 7, non-domain)
My computer (Windows 7 laptop, Non-domain)
Roommate Computer (Windows 7, non-domain)
Now when I setup the Media Sharing host, it and my laptop have the exact same username and password to log in. So when I shared something from the Media Sharing Host, I was instantly able to map to it from my laptop. Now, I wasn't about to give my roommate my password. So I went to the media sharing host and created an account with the exact same name as the one on his PC, then I let him type in his the password he uses on his PC. After that I added him to the shares and bingo! Zero issues accessing everything that was needed.
So applying that here, I believe you should be able to do this: (Please keep in mind I've never tried using windows default authentication this way, so this is a theory and may not work)
1) Create new account on your ERA Server
2) Give that account access to the file share where you are storing your installers (It needs at least READ access to work)
3) Create the exact same account username and password on all client computers, and make it a local administrator.
4) On each client machine, access the Services panel (Start -> Run -> Services.msc) and find the ESET Remote Administrator Agent service.
5) In the Log On Tab, click the dot next to "This Account:" and then specify the new account you created across all machines, then click OK.
If the theory and application holds your clients should now be able to access the share, download, and install as instructed by your ERA server.
I know this is a lot of work per machine, but it is the only way I personally can think of, to get this working in a WORKGROUP environment.
Please keep in mind, I have absolutely ZERO idea if ESET supports this configuration. I have a sneaky suspicion that they likely don't, but it should still work.
Hope this helps!