Set up a proper network takes longer than the deployment lasts, and half of it is thrown away at the end.
Let people use the local connection directly is what actually happens, and it means company work is crossing a network nobody has assessed, on devices that are now outside every rule you wrote.
A consumer VPN protects the link and nothing else. It does not know who the person is, what they may reach, or whether the device is in a state you would allow.