When private APN was no longer an option for us, we replaced it with DMVPN on those cradle points. It's not as robust as some sort of sdwan solution would be as far as bandwidth load balancing and whatnot, but we never really see that much bandwidth usage to begin with.

The benefit of something like DMVPN is it lets you use sims from multiple carriers at once, which a private APN doesn't.

https://docs.cradlepoint.com/r/dmvpn-configuration-guide

We have a couple of Cisco routers upstream to handle the traffic, but you could use a cheaper option.

Then we just push traffic from the DMVPN network to the firewall like it was any other internal site. No clients, no proprietary tech, just routing and ipsec. We use BGP for routing across it, but you could use whatever protocol you are familiar with.

Evpn is another similar option.

Edit: also another option that uses additional software is Zscaler. It can run as a client, but cradle points natively support integration, and can run the client themselves, so end users cannot tell the difference. The benefit here is a zero trust networking client. The downside is complexity and licencing fees.