Update: I've updated firmware to version that uses NBAR and Talos, kept the Layer 7 rule denying all peer-to-peer traffic, and confirmed that printing is not denied from the Fiery Command Workstation s/w to Fiery printer when user is connected to Client VPN.