> Happy for someone to point me at a turnkey Wireguard solution that just-works with InTune.

Tailscale?