InTune and Group Policy Gaps

Guys, looking at using InTune to manage remote windows 10 laptops. Currently our fleet in on-premise is managed for configuration using:

• Group Policy
• Group Policy Preferences

In cloud we have M365 E5 licenses. I am wondering how I can translate the GPO/GPP into InTune or if thats even possible? We do things like use the CIS GPO bundles. These are a mixture of GPO admin templates and secpol settings etc. Can these all be mapped into InTune? Also we configure Office apps etc. via GPO. Again, can these be mapped?

Finally I wonder do we need to use a mix of Intune/SCCM/Endpoint Manager and Always-On-VPN to achieve the same.