I understand the differences for the Zscaler client connector passwords as below:
Logout Password : button to log the user out of ZCC. Once logged out, all services cease to function so this is a good one to have controls on.
Uninstall Password: self explanatory.
Password to Disable ZIA: Turns off Internet protections (SSL inspection, proxy, DLP, zero day protections, etc.). You may choose to leave this option without a password but set an automatic timer to re-enable after say an hour. I’ve found giving the users an ability to temporarily disable ZIA is a good troubleshooting tool and an acceptable workaround to a ZIA issue when perm solution is being implemented.
Password to Disable ZPA: Personally I think you can skip this because the user is only turning off their access to internal apps, not turning off any protections
Exit Password: Same impact as logout. However, this option is temporary. When user reboots, app will reload and user will still be logged in.
Is there a way to retrieve the unique password generated by the device upon registration for each App Profile setting above?