Question - are you configuring the behaviour of DO using Intune Config Profiles? We have this configured and it seems to work very well. VPN devices go directly out of the users home broadband connection (as they're told not to peer), but devices connected to a Corporate network (WiFi or cabled) peer content between themselves. This can be seem in the local activity monitor for DO on the devices themselves. Also seen in the Azure Workbooks