For users at risk, it should be possible to have whitelisted networks. A user might be logged in from both a workstation and a Citrix/Remote Desktop host without that being a problem. Even if these networks are separated by considerable distances.

And they might do this working from home. Which is another complication.