Do you have more information on these 'protected proxies' that you mention? My understanding was more that it was each client was given a health check of sorts & was either allowed, or not allowed after meeting a certain number of criteria.
The biggest problem in such solutions is that you have to identify the applications you have and sure Google is a relatively new tech company. Try to identify all apps/services on big old companies. Until you do that or decommission them, hou have either to keep your old VPN solution up or proxy ALL traffic and use the analysis tools they have to identify apps/services, again no walk in the park.
Of course as mentioned Google has most of its apps/services anyhow on the Internet so you mostly just use the host checking and client identification functionalities of such tools.
At some point you'll have a few dinosaurs on the vpn, and can take those services quietly out back and retire them permanently.
Beyond Corp: The Access Proxy
The trust earning is based on host/machine information as well as user and authentication information.