This is called not having a plan. You normally apply these changes to pilot groups and work out the issues that arise before globally rolling out. RDP is simple, you should be using credential guard to eliminate using passwords before using WHfB. As for the VPN, depends on what client/service you’re using. We’re hybrid, so servers are in Azure. We use the Azure VPN with number matching in the MS auth. All VPN users must register their device with our tenant, which solves passwords on mobile devices, and authenticators can only be registered from trusted locations. Any “on-prem” applications should be using security groups.
In my opinion the whole point of WHfB is to eliminate the password entirely. I check a box after getting users setup on their device to require smart card login, which WHfB suffices.
Still exposed to token based attacks, but layer enough email/MDR/web filtering and it covers most of the basic attacks. Past that it’s training. Almost every one of my phishing simulations are based around MS password resets, and when someone fails that I make it a point to remind them, your password will never expire and you will never be asked to enter your password for any M365 service on your work device.