Correct VPN Remote Acces Setup for Internal and External Users

Hello everyone,
I am currently auditing our firewall and in this work I want to enable easier Remote Access configuration.

Currently we use the following setup:
External users: PPTP with local accounts on the ASG
Internal Users: L2TP with AD-Accounts and PSK (iOS Access required)

The L2TP setup works fine for internal users. We deploy the connection to the clients via a softwaredeployment and users have access via an AD group.

We want to enable external users to go with Windows-tools (no client install required) as well. Thats why PPTP is used (we do not want to hand out the PSK to external companies)

Is there any alternative that enables all requirements but allows both kinds of users to be managed from the AD?

For internal users "auto-deployment" is important. The users should be able to access without having to manually install/download Certs etc.

Any ideas?

Best regards