I think Protect agents that communicate to the Protect server through the cloud is your best option. More on this in the Agent User Guide
All of our reports can be found in Tools > Create Report. I would suggest running each of the Patch Reports and see which works best for you. All of the reports can be export to various formats once generated. Leave the option View Current Status checked, this will scan on the latest scan for each machine scanned by Protect. I'm a fan of the Condensed Patch Listing for details of what is missing, Detailed Summary for a quick look and the Executive Summary for management.
Let me know if you have any questions.