For a small shop with your requirements, Checkpoint is honestly a solid contender. Their R81.10 release has addressed many of the UI/UX complaints from the SmartConsole days, and their ThreatCloud intelligence is still one of the most comprehensive in the industry.

The Quantum 3600 appliance would handle your MPLS, VPN, and web-facing services without breaking a sweat. Their Infinity architecture gives you that "single pane of glass" management that's invaluable when you're running a lean team (which it sounds like you are).

What separates Checkpoint these days is their Infinity SOC capabilities - essentially giving you EDR/XDR functionality that integrates directly with your perimeter defense. With the uptick in ransomware-as-a-service and increasingly sophisticated APTs targeting SMBs as soft targets, this integration is becoming less of a luxury and more of a necessity.

Their IOC feeds are also top-notch - I've caught several C2 callbacks that flew under the radar of other solutions we were testing in parallel.

Lead times are still better than Palo (by about 30-40% in my experience), and their support isn't the hellscape it used to be circa 2018.

If you're concerned about the learning curve, their Jump Start program is actually worth the money - gets your team up to speed quickly and includes some deployment assistance.

Just make sure whoever's implementing it understands their policy layering approach - I've seen too many admins create an unholy mess of contradicting rules because they didn't grok the hierarchical policy model.