789 is classically bad PSK, but it can also pop up when you've got a bad credential OR when Windows has changed the password protocol on you.
Are your users behind the VPN terminating-firewall when they're trying to connect? Because yes, you're going to get weird errors when you do that. You can't connect to the outside when you're inside like that.
For testing, I recommend a hotspot that is 100% not on the same network as your firewall.
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.