We have been having an issue with Endpoint Central and our remote users for awhile now. The problem we have is it seems our IP Scope conflicts with our remote workers home networks. 

Our remote offices have IP ranges from 192.168.1 to 92.168.10; 92.168.20; 92.168.30 ect so most typical user's home network falls within that range. When they are working remote (off the VPN), Endpoint tries to connect them to the site's distribution server (which does not work), puts them under the remote office too instead of our remote user office (with direct communication). We can remote into the user's PC, see them online ect but they cannot pull configs or patches unless they get on VPN (and can then connect to the distro server). 

I contacted support on this recently, and was told the my IP scope needs to be the public IP range of my offices instead of the private range. So I adjusted this, but now most of the endpoints are showing under the remote office, as it seems that IP scope is actually based on the endpoint's private IP. 

How can I actually configure my IP scope/remote offices so it will properly connect them onsite to the distro server and to the remote office when they are remote and off of the VPN. We have users who rarely connect to the VPN so updates and configs pushing off network is very important, but it seems it cant work if their home IP range matches one of our IP scopes. 

What am I doing wrong here? 

It would be a huge help if we could have IP scopes AND manually assign endpoints to offices (so they do not move when their IP changes).