First of all, let me describe the scenario. I am trying to set up a little organizational network for a relatively small private organization (assume ~30-40 people), with primary services needed being email, calendaring, and shared documents. There's no physical premises there so there's no "on-prem", strictly speaking - everyone is going to access it online. There's no need for an internal network, nor for domain-joined machines. Also, there's no existing deployment - this is all being built from scratch. The budget is also fairly limited.
Ideally, we'd like an all-cloud solution to minimize maintenance hassle. At the same time, we also want to minimize the monthly cost per user. It seems that the most efficient way to do so is to get the Office 365 Exchange Online Kiosk plan - at $2/user this gives email and calendaring, but not documents - and then spin up the cheapest (A0) Azure VM with SharePoint Foundation running on it to provide the document service. While the latter would be very slow for a server, but this is also something that would be accessed very rarely, pretty much never concurrently, and mostly to read rather than author, so performance implications are acceptable; while the cost savings from paying $15/month for all 30 users, rather than the extra $2/user, to upgrade to Office 365 Enterprise K1 (which includes SharePoint Online) is significant given the tight budget.
Now on to the question itself. With this setup, I want the Office 365 identity to be the primary one for the users, and for them to only have to remember that one login and password; and if at all possible, I'd like to avoid having to run and maintain any local services on that VM beyond what is necessary. So, ideally, I would like some way to just tell a local SharePoint instance to authenticate users against Office 365, and leave it at that. If that is impossible, I need to come up with some scheme that would enable account sharing and/or synchronization between the local AD instance on the SharePoint VM, and Office 365.
Trying to figure out how to do this has proven to be rather difficult, though. There are many documents on the subject of interop between a local domain and Office 365, but they all seem to assume that the local identities are primary, so the synchronization direction is from on-prem to the cloud, rather than vice versa, as I intend. There is also a lot of seemingly overlapping and confusingly named tech covering that area - ADFS, Azure FS, DirSync are the three ones that keep popping up.
So, where exactly do I need to look, and what do I need to learn, to figure out how to set this all up the way I want? If there are several different options, then which one will be the least brittle and maintenance-heavy in the long run?