Strictly, it can be done from the management server. A tool called cprid_util can be used to push files to, pull files from, or run arbitrary non-interactive commands on a firewall which reports to a given management. cprid_util can also be used via the /run-script Gaia API call.
Sure, it's less convenient than proper support for DHCP options in clish and via the Gaia API would be, but it's at least possible.
I do wish Check Point would give up on clish. I understand the goal: it's nice to have a single "configuration" rather than state spread across dozens of files. Greatly simplifies change management, auditing, and so on. It just doesn't work well. It's consistently the worst part of interacting with a firewall or management server. Useless for troubleshooting (no pipes for grep, awk, etc.; no loop constructs; no file I/O), incredibly irritating on VSX, there's all kinds of missing functionality like the ability to set DHCP options. And it's more than a little ridiculous that Check Point's own article on using DHCP options (sk92473) acknowledges that clish will muck up this config so you need to set the immutable flag to prevent it from undoing your work.
