The office allowlist without the client install

Be honest about what the office VPN does for your internal tools: it puts your office IP in front of them. That is the whole job. For that, every laptop carries a client and every new hire enrolls in a network.

A proxy permission group of type ip takes your office CIDR; default deny closes everything else. The check runs in the proxy on your own server and covers every URL the container publishes: the app port, the terminal, the files. Nothing installs on any laptop, because the browser is the client.

From the office, the tools are bookmarks. From anywhere else, they refuse.

The VPN was an IP allowlist with a client install; keep the allowlist and drop the client.