Domain-joined laptops off-site?

How do you handle this best? We've generally told our users to just lock their AD login session, not logout, but this isn't always possible and with potential work-from-home coming up, I'm wondering what the "best" solution is: local user account? Can we switch to authenticating with Azure ADFS instead? (If so, I'm very fuzzy on that at the moment, as we've just recently set up that AD to Azure sync.)

Edited to add: no VPN at this time. We're a k12 that's heavily into G Suite, so there's no expectation or real need for users to have access to our file shares when off-site. Will be checking that GPO for cached credentials, thanks!