If you have an on-prem server, is there a way to use Office 365's Azure AD for authentication without requiring an on-prem AD server?
Not directly. With AzureAD you can enable a service called AzureAD Directory Services, this allows you to join a machine to a domain similar to how you would traditionally do it. It is not 1:1 as far as features, but it can provide NTLM/Kerberos authentication. We use this with Azure VM's, and usually it's in combination with AzureAD Connect used to sync local AD object to AzureAD (though it is not required).
Based on that -if you have this configured and a VPN tunnel you could then join a machine to the directory service.
Directory service is an additional PAID service you must explicitly enable, and it requires you to configure virtual networks in Azure as well.