I've just spoken with one of the chaps, so it does need a proxy server in place, and the browser passes user credentials, that's how it's able to differentiate
You can also enable manual authentication as well, so that if the user credentials aren't passed the users will be forced to authenticate before browsing.
Integration with Squid seems pretty straight forward, and if you need any help the support chaps are always here to give guidance