SEP Network Threat Protection

Hi, 

I have a customer that due to some issues with wants to have the abilty to have clients, while on the coorporate network, utalize a "light" version of network threat protection policy vs when off the network - have all rules of the firewall enabled. I understand the best method to accomplish this is to use the location awareness. According to the customer, they feel with all their other tools in place, they are protected... 

Question:

How is this accomplished and what specifc configuration is used - Best practice? 

What are the cons to configuring the policy in this way? what possible risks would this create? Vulnarabilities etc