AzureAD joined Machines and MECM over VPN

I have some AzureAD joined machines that alos have a VPN into my datacentre for file share access etc. Currently they are using Intune for configuration and software deployment. I find Intune limiting for the latter and would like to leverage our MECM (and co-management) infra for this. I have a CMG but it can be expensive.

Is it possible that AzureAD joined machines could use MECM directly (as opposed to the CMG) when connected over the VPN (i.e. when they have line of sight of our on-prem MECM infra) ?