Global Protect is the product name of the remote access VPN that is a feature of Palo Alto corporate firewalls.

GP supports many different types of configuration, but if the admins of your wife's workplace have chosen to use a traditional VPN protocol like IPSEC then the great firewall will be blocking that by default. She could open a ticket and ask if they have a different configuration for her device (probably SSL) that might offer a backup option for access from a China WiFi/broadband.

But getting good slug of roaming data for a sensible cost on a HK SIM is very much the easiest option.