That answer depends on what you are trying to enable by deploying vShield Endpoints. They are deployed on each host. You would deploy the vShield Endpoint VMs on any host that will need the services that vShield Endpoint.
Note: with NSX 6.1, vShield Endpoint has been upgraded to Guest Introspection.
Usually I would run the (production) VM's on the compute clusters, so I guess the endpont deployment should be done on that hosts ...