This message was deleted.

We are looking at Citrix ZTNA, but haven't gotten very far down the path yet.

Azure AD authn + Conditional Access would suit your requirements?