Looking for ideas for this use case

[Rich-VPS]

I have some users who travel outside of areas we normally allow connections from (think vacation on a cruise etc). I want to given them access to M365, perhaps a few SAAS apps protected by SSO, but not necessarily to our Hybrid environment. I have several extra IPs on our perimeter NGFW available. Currently the only reason they hit the NGFW is to VPN into a hybrid system or two.

Is there a way to create a public interface they could connect GP to that could then send their traffic out (even over another interface if needed, I have IPs to spare) and thus taking advantage of all the features in my NGFW, security, DPI etc, and limit where they can go, such as M365, and a few other SAAS apps?
Is there a better solution (this one doesn't cost us anything in theory) 


I hope I describe that well enough. 

[OtakarKlier]

Hello,

Have you looked into GlobalProtect?

Just a thought.

Regards,

[Rich-VPS]

we currently use it. The problem is not using GP but in how to configure it for multiple scenarios. A scenario where users can connect to one interface and use that as a split tunnel when they are in the proper approved locations and the other where they can connect and their internet traffic gets proxied for them using another interface. this way when they are not in an approved location they can use a vpn and we can control their access.

still looking for a solution.