Foreground Mode and Nofication in lock screen
If your device agent is configured to operate in the default "persistent" mode, the disconnection initiated by the device end-user should only last for a short period (less than a minute by default), and the agent will repeatedly retry getting connected again. So I wouldn't worry too much about end-user being able to initiate disconnection momentarily.
However, if you really want to hide notification in lock screen, you can configure the corresponding option ("Do not show notifications" for "On Lock Screen") in Settings->App Manager->MobiControl Agent. This is meaningful, of course, only if you also use kiosk mode or application run control or feature control policy to disallow end-user from reversing this option configured in Settings.
Thank you very much. Do you happen to know if Mobicontrol can restrict those notifications?
I don't think so, at least not at the moment. I will be in cloud nine if they have it now or in the very near future.