So couple of major issues here.
1) I had a web control set to block discord in all possible ways and url's I could think of. This (and presumably everything) can be bypassed by several free VPN/Proxy extensions in Chrome and Edge. I would have thought that the endpoint being local would have blocked this anyway as it's the same URL. This is even with the new decrypting SSL sites (early access though)
2) Even with the proxy/extension removed and purged the site continues to work - I don't mean just gets to the front page, you can actually navigate it fully. It's as if the site frontloads everything into cache, like it's a local web app or something. I presume this will time out at some point but I have no idea of knowing when.
So all the user needs to do is find some bypass to the web control, and the sites accessible regardless of the settings.
I've build a brand new VM and managed to recreate this issue with such ease.
As the devices are roaming, both in a managed building and at home/hotels/other houses etc. it means the endpoint web features are my only hope to stop access to sites like these.
Anyone else had this?