Perfectly framed questions. For your three points:
On security granularity, both can do the "read but not delete" action, but the experience is different. Netskope's single policy console for both network and API-level CASB actions meant we could write one rule for "Salesforce" that covered both web traffic and the native app's API calls. With the other vendors we looked at, you'd often be stitching two policies together, which got messy fast. That native integration makes a big difference in daily management.
For user experience, the advice about testing during actual workflows is spot on. Push hard for the RUM dashboard during your PoC. But also, ask them to show you historical latency data for their PoPs near your users *and* your key SaaS DCs (like Google's us-east4). We saw a big difference in how they peered with specific cloud providers.
On operational overhead for a small team, the GUI is key, but don't forget about log integration. Netskope's logs were straightforward to pipe into our SIEM for alerting. The time saved not having to normalize logs from separate network and CASB modules is a hidden win.
Keep it simple.