Azure Active Directory Premium P1 - Windows 7 - Group Policy

Depending on how far you're willing to go, you might consider cutting them entirely to Windows 10 and use Intune MDM for all your endpoint management. You'll get most of the important GP functionality in an easy to manage interface, and then if there are gaps you're not comfortable with (although that gap shrinks with each semi-annual Windows release) you can close them with remote PowerShell -- again using Intune. But in most cases that won't be necessary.