There are a few ways to deploy the agent. Of course, physically touching the system... which is difficult in your situation.
You can also use Intune for deployment: Deploying LsAgent with Intune - Lansweeper IT Asset Management
You can also play with deploying via GPO.
Another option is to put the installer on a network share and have your users install it. Granted, you may have issues with admin rights requirements, etc. If you go this route, might I suggest you let your users know you aren't phishing them when you send out this like by way of company-wide meeting update.
To your first question, LsAgent is designed to report to an encrypted cloud where your system will retrieve it. We do have LsPush that is designed to push straight to your server. Introduction to the LsPush scanning agent for Windows - Scanning your network - Lansweeper Community
Hope this info helps.
Tim N.
Lansweeper Employee