CATO SDP Client
This is the direct download for the CATO SDP client: https://clientdownload.catonetworks.com/
Just download and install it if they didn't get the email from the system. It authenticates through Azure just like Office 365.
Users are assigned in AzureAD. The groups can be search for via "VPN-CATO".