As you probably surmise, both are correct as to comma placement, but which usage is best is rather subjective, depending upon what you want to emphasize.
I would say that usage #1 tends to emphasize the unfortunatality of the need for being online, and usage #2 emphasizes it less. Taking @BarrieEngland's suggestion as usage #3, I would judge it as having the least emphasis of the unfortunatality among the three choices, namely because that placement seems to interrupt the flow of the phrase the least.
So, the best way to express the unfortunate need for being online, without making a big deal out of it, is to follow @BarrieEngland's suggestion...
3) "...though unfortunately you must be online for this feature to work."
And this version doesn't require commas.