Is there a way a user to disable the roaming client if needed once they are at home? I know the point of the client to to secure the company owned system from malware. Is there a way to have the roaming client to only detect malware and not block sites?
You can create a little batch file to handle stopping the process and restarting the process. I looked into this issue before and created a small script that when I double clicked on it the process for Umbrella would stop, you could use this at home. When I clicked on it again it restarted the process, for use when working from home.
Alternatively you could have the Umbrella working through the AnyConnect client and only when they are using AnyConnect does the Umbrella client work. If they already use AnyConnect you can configure it so when it see's a trusted network over VPN it will switch off Umbrella in the AnyConnect client. I know this seems like a work around but could be useful.
Do the users have admin rights on their devices?
I created a batch file when first testing Umbrella to see if the RC would have preference over network version of Umbrella.. Click on the batch file and Umbrella turns off and then click again and it turns on.
To make sure it is off or on you could give a message on screen or link it to https://welcome.umbrella.com/ which would tell you if you are using Umbrella or not.