If Threat Prevention quarantines a trusted file on a client system, you can restore it from ePO - On-prem.
Task
Select Menu → Client Tasks → Client Task Catalog.
From Client Task Types, select Endpoint Security Threat Prevention → Restore from Quarantine.
Click the name of an existing client task or click New Task.
Configure the settings and click Save.
Under Actions, click the Assign link, specify the computers to assign the task to, then click OK.
Click Schedule to schedule the task, then click Save.
See ePO - On-prem Help for schedule information and the Client Task Assignment Builder.