You should probably use IKEv2 as a primary if you have Windows Vista/7 clients and 2008r2 servers, with a fallback to SSTP if for whatever reason UDP port 500 is blocked at the client's site.
SSTP has a severe performance problem in that you get TCP-in-TCP for most data traffic. This causes the "inner" TCP layer to be mis-informed about the actual packet loss on the network, resulting in huge delays or disconnections. See this link for detailed information on that issue.
Our own tests showed SSTP performing terribly on lossy networks, particularly wireless networks at hotels, coffee shops, mobile broadband, etc. So we intially chose IKEv2 as our primary mechanism with SSTP as a fallback. Neither SSTP or IKEv2 require client certificate deployment, but they do require all clients to trust the certificate of the VPN server. The VPN server certificate is easily deployed via Group Policy.
Another problem common to PPTP, SSTP, and IKEv2 in the Windows implementations is that they do not verify that the client computer is trusted, only that the user who is connecting knows a password and has VPN permissions. This issue ultimately led us to go back to L2TP with client-side certificate deployment using Microsoft Certificate Authority to issue certificates to trusted machines. You can configure NAT traversal for L2TP with a registry setting (again deployed via Group Policy).