Beyondcorp is still great for all http network services.

Having an nginx loadbalancer doing all the beyondcorp stuff and forwarding on any authorized request is pretty straightforward and covers a large chunk of what your employees will be wanting to do. It easily lets you allow employees to access low risk services from their personal unmanaged and untrusted phones. It also means any home grown internal service doesn't need to do Auth - it can just look at the trusted header from the loadbalancer and know who the user is logged in.

You have then at least substantially lowered the remaining attack surface, which now consists of just the non-http services (shared drives, SSH, remote desktop, etc.).

For those, a VPN server allows you to authenticate the user and device, and a big dynamic set of iptables rules lets you decide which sessions can access which service.