Thanks for reaching out and apologies for delay in response.
At this point of time, users will need to exclude our service URLs from their proxy Global Secure Access points of presence and IP addresses - Global Secure Access | Microsoft Learn and ensure firewall lets those destination outbound, basically not allow the tunnel to be established.
Hope this will help.
Thanks,
Shweta