We are just kicking the tires on the Netskope Private Access functionality.  We are trying to understand if it would be possible to drop certain traffic out of the Netskope tunnel and onto the local wire.  

For example, we do not want to send print jobs from the endpoints to the publishers if we can just break that traffic out of the tunnel and drop it right to the printers in office.

Any advice?  We have been tinkering with on-premise / off-premise steering configs but cannot put a finger on how this could/shoudl work.