There are two ways to do this:
Make sure you set up your access restrictions. When these are set up, they will only show the punch in buttons for the registered IPs. You can see how to set these up here.
On the MANAGE MY BUSINESS page, there is an ‘Employee URL’. This URL should be given to employees to log in from home. It automatically hides the punch in buttons, regardless if access restrictions are in place.