That is the same as what I had listed for immediate activation:
"Immediate activation:
The OS X agent acts slightly different from the Windows agent during installation. The Windows agent installs and does not attempt to broker immediately unless you edit the installer and add a broker -r command to it. The OS X agent however already has the broker -r command added in. This means that if the OS X agent is in-band (can reach core and CSA) during installation it will (mixed results here) automatically broker."
That method will work - I was just providing all three cases to trigger the activation for a more complete and detailed answer.
With the way that you currently have it setup; if you install the agent while it is off the network and not on vpn - it will not automatically connect to the CSA and broker. You will still need to use the methods I listed above. The reason for this is that the agent does not have embedded credentials to initiate the broker'ing process. However if you can get all of your devices to broker during their initial setup then you should not have to worry about out-of-band activation.
-Peter