This is tied to their AD credentials.
If there is an external employee that is getting locked out they would need an AD account in the first place. So just reset their password and set it to never expire and to not prompt a password change on log in.
After they log into VMware as part of the virtual desktop there should be a bar at the top for options regarding the vmware session, in there should be an option for ctrl alt del. Have them do that to reset their password