The solution we provide is via Citrix. So they would get a login such as pahosted\origin.user with a password. They would then connect to PA hosted as our other clients do and run the applications via Citrix.