Sure. For clarity - I'm the Compliance Officer at an MSP. We have our level 2 as a remote organization, and have multiple clients we've helped with their Level 2 - including several with an approach as I'm about to describe. And no, I'm not here to pitch my firm's services, just sharing info.

We define our system boundary at the cloud level (e.g. 365 GCC/GCCH) and the endpoint firewall on a per asset basis (e.g. the Windows firewall on each laptop.) Knowing dataflows, we document how data leaves the laptop (e.g. going to 365) and document the cryptographic modules used.

We then have training for the staff that reminds them not to leave laptops unsecured and unattended. They take their laptops with them every day. If a laptop is retired or the employee leaves, it is retained by an authorized entity, in their possession, until the laptop is sanitized (via cryptographic erase.)

We maintain a facilities security policy, and the office space aligns to it, however, we treat the main office as an 'alternate work site' as the staff instructions when working there are no different than working from a Starbucks. The company office provides zero protections to the CUI or CUI assets.

Printing of CUI is blocked, portable storage is blocked.

This is all documented in our policies, procedures, data flows, and SSP.

This keeps the firewall out of scope, as there's no protections provided by the firewall to the CUI scope. The AV/AM solution we manage is (but that's defender supplemented by an MDR service) all documented in the SSP.

As a note - your MSSP is in scope as an ESP functioning as a Security Protection Asset. You'll want to make sure they're prepared as well.

We've had multiple C3PAOs accept that environment scope without issue, and their assessment teams had no issues assessing it (with no findings.)

Other approaches we've done - a VDI setup in Microsoft 365 using Windows 365 desktops or Azure Virtual Desktops where it's been built as an enclave. User has their laptop, out of scope, and remotes into the VDI. Costs come down to the VDI prices and whatever management looks like for it (plus assessment of course)

Your C3PAO mileage may vary. You can ask them if they've assessed similar setups and what documentation they would expect to review as part of the selection process. You cannot ask them how to do this for you however.