Our company has a small central office with about 8 staff where we manage 20+ small remote stores. Each remote store has 2-3 PCs running Windows 10. We do not need file sharing as we use G Suite. We do need central control of user authentication, group policies to lock down the PCs so no new software can be installed or modified, and the ability to remotely push out software.
Is this possible using Azure AD or Azure AD Directory Services or similar or will we need a full Windows Server with Active Directory using VPNs to connect all remote stores?