>Why do they need to log in on that particular server? I can run SSMS locally and connect to every SQL instance in the company from it.

Because its their job to look it up on occasional basis for monitoring purposes, batch job configuration, agent and stuff like that.

As far as running locally, this depends on local network of each users as some of them may not have priviledges to access a remote desktop connection from their own network so they would have to connect with VPN inside the server network. But, they can use any other server which has SSMS on instead of the SQL Server. But, this is the same story over there. So, we just add in the build book the proper procedure on how to disable this. I would have been nice to have something global in the registry that none would be bothered with this.