Users have multiple options:
Managed client: Workspace ONE is used as a mobile device management (MDM) to manage endpoints such as laptops, smartphones and tablets in an enterprise. The Workspace ONE client is used to connect to the VMware SASE POP.
Stand-alone: Third-party MDM can be optionally used to install VMware Workspace ONE VPN client to the devices, or the endpoint can download and install this VPN client directly. The Workspace ONE VPN client can then connect to the VMware SASE POP.