I would think of BeyondCorp as end users accessing services through an application-layer perimeter from a public network, instead of directly from a private network.

The network where the services actually sit becomes, in effect, even more private.