How To Handle Dynamic IP Addresses Of Clients?

With most users having dynamic Ip addresses how does one handle the Azure Firewall? 

I do not think setting a range for the IP's is useful because different ISP's have different ranges...

What is the solution, VNET Peering? Use a VPN/ Virtual Network Service? At another additional unnecessary cost & further complicating things. 

It would be helpful if the Azure Security pinned thread contained content on the options of security implementation within Azure.