F5 APM - limiting use of client connect mode

Not ideal... but quick and dirty... what about leveraging multi-view DNS? Have your DNS platform return NXDOMAIN when trying to resolve the name internally (and then the connection should fail). Externally, have it resolve to the normal publicly accessible address. When you need to fire-up/test/train with user in the office, the IT admin can enter a hosts file map temporarily and remove when done.