You cannot install DMA via GPO when a client-to-site VPN does not exist to process or update the Group Policy Object (GPO) changes.
Instead, you can install DMA by email following the directions outlined in the How do I deploy the Device Management Agent through email? article.
This will install DMA in limited mode.
Important
HealthCheck for Office 365 is a module of DMA. When DMA is installed in limited mode, HealthCheck for Office 365 cannot detect and report (in MSPComplete) on upload and download network speeds.