There is another issue, that US citizens ussually do not encounter. When you setup a VPN on amazon, for example, you would like only some of the traffic (intranet) to go through that VPN (or SSH socks proxy). The rest of the traffic should go directly to the internet. The reason being is that the roundtrip is too costly.

I am not sure configuring these settings are trivial, and VPN clients provide that out-of-the-box.

Same question. Do you refer to using SSH and socks proxy. If so, is that a viable solution, in your experience, with less techy employees?

Less techy employees shouldn't be on any private/internal networks. Just give them an HTTPS web panel to work on authenticated by the SSO system.

SSO is not enough. In secure systems you are ussually required to provide both network access, and applicative access restrictions

It would be utterly transparent. Please don't be ignorant.