Not sure I understand completely. Your customer has a corporate network with a perimeter, protected by a firewall (hopefully), that allows remote users to VPN in, and ISE is used for authentication of those VPN connections. ISE possibly authenticates their wired and wireless users too but we are talking about remote users. You are saying that they want to block remote users from accessing corporate resources if they are not connected to the VPN, right? Their perimeter firewall should not allow any connections from the outside to the inside of their network. The firewall should only allow source IP addresses from the remote access VPN pool to connect to the inside. That will prevent someone from the Internet from gaining access. That should already be in place. If your client also has cloud-based resources and they want to prevent just anyone accessing that, then the cloud-based system should have some filtering to only allow source IP addresses from your corporate-owned IP space.
Not sure if that is what you are looking for. Can you elaborate on what you mean by "by-passing" VPN?
