The issue was discovered by @JaredBusch (thanks!)
FreePBX has several types of allowed IPs under Connectivity > firewall >Networks
When you more or less want to white list an IP address, you mark them as either Trusted or Local.
Trusted = allow access to anything on the server, any port, no restrictions
Local = allow access to the ports known by FreePBX (connectivity > Firewall > Networks > side hamburger menu > Services - once here you will see the following tabs Services, Extra Services, Custom Services, Blacklist) and marked as Local.
At some point, for an unknown reason when entering IPs into the Networks tab I changed from using Trusted to using Local. My personal IP, along with a support persons were both under Trusted, but everyone else -all those who were failing to connect to FOP2 - were listed as Local.
Because Local seems to be a bit more locked down, I decided to add a custom service to the Custom Services tab for FOP2 4445 TCP and UDP. I then marked it as Local, click the green checkbox to save.
Upon saving that, all users listed as Local in the Networks tab could now access FOP2.
I hope this helps someone else someday.