Shared computer activation across all of our devices

[Greniti]

Our company has staff and interns. Staff is licensed to use E3 and interns E1.

We have 15 offices, some of our users travel from one office to another and sign in to different computers, pretty much any computer that is not being used. . We also have VDI in place  and they all remote into it. We have a mixed usage of local pc and VDI.

Staff(e3) will use office 365 pro. Interns (e1) will be using web version.

I have a few questions and what would be the best most practical way to handle this. 

1. Can we set up all computers with shared activation including VDI - is there any limitations ?

2. Seamless sso is in place with azure ad connect , do we still need roaming licensing tokens for shared computers if seamless sso is working? I believe licensing token roam was necessary so that users do not get the prompt to activate. Is it necessary now too ?

3. Some staff just uses one dedicated pc all the time, but some are used as dedicated/shared computer. 

Is there any licensing issue as the interns are not licensed for e3 ? It's my understanding that if Interns(E1) try to use office 365 pro(or 365 apps) they simply won't be able to activate it and it will be in view only mode.

Thank you.

[#2]

I think i found answer to question 2 from MSFT doc:
If you don't use single sign-on, you should consider using roaming profiles and include the %localappdata%\Microsoft\Office\16.0\Licensing folder as part of the roaming profile.

Also for limitations, since a new Licensing token is generated for each computer, then a roaming licensing token makes no sense.