Hello Duncan15,
This local modification is controlled by a setting in the Business Hub. You can disable this control under Policies -> select the policy assigned to the device -> Settings -> Firewall -> Networks, enable the "Disable the network profiles management by this console" toggle and save the changes. Wait ~5 minutes for the setting to propagate to the device, then reboot it. After the reboot, you will be able to modify the profile locally.
Alternatively, you can add the network in the same area of the policy under "Defined networks" as "Trusted" which will override the local automated profile assignment. Here you would add the MAC address of the router of which the device is connected, you would find it under the local client in the details of the network in the Firewall component.