According to my understanding,our scenario solution is achievable without using boundary.
Normally, when our client wants to get the location by querying our DC:
If the DC reply the client , our environment will in scenario 1:our users on VPN.
If the DC still does not reply to the client after several attempts to connect, our environment will search for the Internet tunnel and then we will in Scenario 2: Users on Zscaler or CMG.
If the response is helpful, please click "Accept Answer" and upvote it.