If IT does not control the hardware of the remote users, then a GP version can be provided directly via the GP portal. Once the user connects to the GP portal and authenticates, he/she will be presented with several download options out of which he/she will have to select the correct version depending on the hardware being used. An example of the GP portal page is displayed below:
Note: This can potentially put extra load on your portal!
Alternatively, if the user has access to the GCS Portal he/she can download and install any version of GlobalProtect that's available on the portal. All you have to do is login to the support portal: https://support.paloaltonetworks.com/
Once you're logged in, navigate to Updates > Software Updates and select the correct filter using the drop-down menu, as illustrated below:
In doing so, you will be presented with all the available software versions of the filter you've selected. As you can see in the screenshot below, all versions come with release notes that I strongly suggest you read before trying any version, because they contain information regarding known and fixed issues :