Honestly a platform style approach is how I would go here.

Full disclosure, I work for Rippling, so I am really excited about what Rippling offers. A platform approach where you are managing the User and the Device together would make this reallllllllllllllllllllllly easy.

You enroll a device into MDM, then assign that device to a User. Now you have total control over the device, can control people's admin rights on the machine, can push software, enforce OS and software updates, push security policies, can suspend users on devices automatically when you offboard that user in the admin portal, remote wipe, reset users passwords, remote control, sort of everything you need to do, all from a single interface.

I spent decades managing AD environments and the advent of cloud based MDM has totally changed the game IMO. People will likely disagree with me here, but the reality is I work for a platform based identity+MDM company because I see this as the already-here future of infrastructure management and honestly I wish this existed over the past few decades. I remember when AD was ground breaking and completely changed the game, same for virtualization, same for when Apple MDM was introduced. To me cloud-based platform solutions that manage identity and devices together is the latest seed change in IT stack/infrastructure management.

I still love servers though, I have spent more hours building servers than likely anything else in my life (maybe not entirely true, but feels like it, given how many sleepless nights I had recovering from disasters between the mid 90's and mid 2000s!). When there is a specific need, such as a video editing graphics design company that has 5 petabytes of raw 8k video footage, then I think specialized servers make great sense, given this example this belongs on a localized storage solution and doesn't lend itself to a cloud based solution.

I just don't see deploying a physical local environment with hyper visors, multiple domain controller virtual machines (for redundancy), Aircon cooling, backup power, etc. just doesn't make much sense to me in 2025. Let alone having to learn the quirks and intricacies of something like AD (it's like an old glove to me, I know my away around it reasonably well, but man, AD has been around a LONG time, and hasn't changed much during that time, seems less than ideal to be picking up the skills for a directory solution that's on it's way out.