Another alternative might be possible if you are using something like ADFS as your identity provider. You can set logon hours in your AD, and users will be forbidden to logon outside these hours.
Something similar would also be great for Gateway limits, setting office hours (it would be impossible per time zone, but globally if the location are localized) with stricter limits would be a cool thing.