By default, the Palo Alto GlobalProtect client automatically starts after logging into your macOS and tries to auto-connect (if configured). This may not always be desirable and there's no real straightforward way to disable auto start from the application itself. Fortunately, as with many auto-start apps on macOS, you can disable auto start through the launch agent files.

Launch agents define what software to start at logon. The global ones (i.e. applicable to all users on a Mac), are located at /Library/LaunchAgents. Although they have the extension .plist, they are in fact XML-files and can be edited with any plain text editor. Note that if you are editing global launch agents, you will need to do this as root (using sudo through Terminal) or copy the files to your desktop, change them, then copy them back, entering your admin password when prompted.

To stop GlobalProtect from starting at logon, there are two files to edit, located at /Library/LaunchAgents.

In the file com.paloaltonetworks.gp.pangpa.plist, change the parameters RunAtLoad and KeepAlive from <true/> to <false/>:

<key>RunAtLoad</key>
<false/>
<key>KeepAlive</key>
<false/>

In the file com.paloaltonetworks.gp.pangps.plist, change only the parameter RunAtLoad from <true/> to <false/>. Do not change KeepAlive in this file.

<key>RunAtLoad</key>
<false/>

To see whether it worked, restart your Mac. GlobalProtect will not start automatically but you can still start it manually whenever you need it.

It is not possible to quit GlobalProtect (not even with ⌘ + Q), so if you want to quit it, you'll have to use Activity Monitor.