Prisma Access Security policy enforcement

[S_Williams901]

So I was looking at prisma access content and came across this:

If traffic is initiated from a service connection and bound for a mobile user or a remote network, Prisma Access cannot restrict the traffic. The traffic hits no security-enforcement point, because the RN-SPN and MU-SPNs enforce Security policy only on sessions ingressing into Prisma Access from behind the security processing node. This is not a recommended architecture.

The proper way to control traffic sessions that come out of a service connection is with an on-premises firewall on the network behind the service connection. An on-premises firewall at the data center is the correct way to enforce Security policy for a session initiated by a service connection to a remote network.

when they say firewall on the network behind the service connection, can this be the same palo alto that the service connection terminates to? I would assume so no?