A company has a mobile sales force of 500 laptops and personal devices that connect from hotels, coffee shops, and home networks that frequently sit behind NAT and restrictive firewalls that only permit outbound TCP 443. The security team needs a VPN deployment that provides per-user authentication, works reliably through these networks, and requires no static peer configuration. Which VPN deployment type best meets these requirements?