Some of the companies have a GPO 'Run only allowed Windows Application' set. For the Clickonce to work in this scenario here's the list of exe and dlls that needs to be added.

LaunchApp.exe
MyAppName.exe
MyAppName.exe.application
MyAppName.exe.deploy
MyAppName.exe.manifest
MyAppName.vshost.exe
dfsvc.exe
dfsvc.ni.exe
AppLaunch.exe
rundll32.exe
dfshim.dll
dfdll.dll