Better B
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/mvpn/general/mobile_vpn_internet_access_options_c.html#:~:text=Default%2Droute%20is%20the%20most,traffic%20and%20provide%20increased%20security.

I think is better B
Internet Access Options for Mobile VPN Users For Mobile VPN with IPSec and Mobile VPN with SSL, you have two options for Internet access for your Mobile VPN users: Force all client traffic through tunnel (default-route VPN) The most secure option is to require that all remote user Internet traffic is routed through the VPN tunnel to the Firebox. Then, the traffic is sent back out to the Internet. With this configuration (known as default-route VPN), the Firebox is able to examine all traffic and provide increased security, although it uses more processing power and bandwidth. Allow direct access to the Internet (split tunnel VPN) Another configuration option is to enable split tunneling. With this option, your users can browse the Internet, but Internet traffic is not sent through the VPN tunnel. Split tunneling improves network performance, but decreases security because the policies you create are not applied to the Internet traffic. If you use split tunneling, we recommend that each client computer have a software firewall...