You already know that you can configure your TMG clients as Firewall clients with the firewall client software installed, or you can set them up as Web Proxy clients or as SecureNAT clients. Web proxy clients are configured via the web browser. SecureNAT clients are configured by setting their default gateway to the IP address of a TMG server.
The client type affects hostname reporting, and it’s important to understand how reporting will differ depending on how clients are configured. This article explains those differences, and contains instructions for applying a Microsoft hotfix to enable logging of hostnames for SecureNAT clients:
http://www.fastvue.co/blog/reporting-on-hostnames-with-forefront-tmg-securenat-clients