It seems like when this talks about "enabl[ing] teams to access private company resources", it means "access 3rd party cloud services that support IP whitelisting"? For example, if I set up another service on the internet to only allow connections from the dedicated VPN server IP. But it wouldn't let a remote employee access a service running in the company's office LAN. Am I misreading that?

Additionally, what protections are in place to ensure Portal Cloud staff aren't monitoring the traffic or accessing a customer's "private company resources"?