If you check out the link in my sig, you'll see a few things that might be useful, mainly designed to be handed to new players. Look particularly at the New Player FAQ and the "Reality Of" images... (metatypes and WWSD?).
The main thing I'd say to any group coming from D&D is that Shadowrun operates on a different principle which is that of eggshells armed with hammers. There's no real levelling up in the same way there is in D&D. A starting character can kill a dragon with preperation, cunning and decent weaponry. And a 300 karma character will be burnt to a crisp without them.
You get better. You get more dangerous. You never become immune to that shotgun in the back of the head. This is important because it is why Shadowrun is so fillled with deceit, treachery and stealth.
I hope the above wasn't patronising, this is just what I say to new players in my game who have come from a D&D background.
In regard to your specific questions, firstly I'm okay with a hacker working "off-site, " purely in the Matrix. A lot of GMs will resent that and stick lots of wi-fi blocking paint and non-matrix linked data-systems in order to force the issue (and a resulting tendancy toward AR). I prefer a more graded approach. If you look at the introductory adventure on my site, you'll see that I have both useful things for the hacker to do if physically present (such as locks to hotwire, a drone to rig), but a route to working remotely if need be, which I made slightly more difficult. Working remotely is fine with me, but the pressure to be on site can more often come from the other players when they need the hacker to do something directly (such as when a corp employee hacks the team PAN and shuts down all their useful comm-programs such as map displays).
Don't underplay the role of AR in general though, it should be all over the place and all of the players should make use of it. For example, tactical programs that display their deployment on the team net to all those wearing smart glasses, AR contacts or cybereyes. In fact, small though it is, one funny thing once was the previous example when the team PAN was hacked by a late-working (and very loyal) employee who promptly shut down half their commlinks. I reached over my screen and took their map away (and all the little scribbled marks showing where guards currently were). Much howling and complaining there was, oh yes!

AR should b fairly omnipresent so make sure the mages have smart glasses and are wearing their "mouse ring" (one way I visualise someone using AR without DNI is a small positional ring that indicates to the comm what the user is clicking on in the display).
Hope some of this helps. As I say, the introductory adventure will show some of how I personally run the matrix component of a run. It's a mini-mission and doesn't have any of the legwork where a hacker often excels, but illustrates the on-site component, I feel.
-K.