the firebox does not drop some new vpn tunneling like :
I cannot get to the point where App Control would do anything, because when I try to go to the web site you linked, WebBlocker blocks it as Proxy Avoidance. If I bypass that block and try to download the file for Windows, that gets blocked by HTTPS DPI due to the Windows EXE/DLL blocking.
Do you use HTTPS with content inspection enabled?
Users can download the app on their phones or laptops off site for example.