CMG-enabling remote SCCM clients

Hi all,

What's the best way to attach SCCM clients to a new CMG when they're unable to come into the office?

Current scenario:
- On-prem SCCM server
- SCCM-managed Win10 devices, orphaned for now because of enforced remote working
- Working on implementing co-management

The options I see at the moment:
1. VPN - need to get Always-On with device channel working?
2. Auto-enrol in Intune and leverage Intune to modify SCCM client config (would lead to temporary co-existence with SCCM/Intune which I think is unsupported)

I'd prefer option 2 if possible.

thanks in advance.