Offshore employees at Client sites

We have a new client with handful of offshore employees . They need o365 access, server / vpn access as we as third party finance apps ( qbo, HR apps ) . They have been served with Splashtop with MFA to a an on prem Windows 11/10 vm . There are complaints of issues with dual monitor usage . We are improving security all over and will be moving some infrastructure to Azure . All offshore employees are contracted from a HR agency which provides a laptop that they manage and can remote in for support . They had a phishing incident recently . We are considering shipping over Azure joined devices over for their usage . I did consider having them use Azure VM but we still don’t have control of the laptop they use and the HR agency has full control over it which will limit us if we have to investigate or monitor . Logistics and shipping is a concern when hardware goes bad but it seems that this the sure way . It would be great to see what others are doing . Thank you ,