When installing or using the standalone roaming client software for OSX computers, a prompt appears asking users to allow or don't allow a VPN configuration. Select Allow to enable IP Layer Enforcement.
This user prompt is triggered by Apple's System Integrity Protection feature, which is a part of OSX as of version 10.11 or newer when IP-layer Enforcement is enabled for roaming devices.
This prompt is a one-time click to accept, per user. After the connection is allowed, the message will not return.
If a full silent deployment is required, turning off the IP-layer enforcement feature will allow the client to install and startup without this prompt appearing to the users. Although this will not stop the prompt from appearing later on if the feature is turned back on.