Do you deploy a script per-user with mdm/intune to set up the wireguard tunnel whenever someone initially logs into a laptop?

I've investigated a few options for non-admin wireguard on Windows and it's all pretty messy.