Balancing AI risk assessment with VPNs

So I really like the features AAD has that allow it to evaluate each individual sign-in against patterns of behavior, the impossible travel notifications, and other features in that vein. What I'm curious about is how you balance the need to keep that information reliable by not skewing sign-in data, and the recommendations to connect to a VPN while on unknown networks like a coffee shop or an airport and other networks like that. We want our users to be secure, but I also don't want to run the risk of locking them out because their user risk level is raised due to a legitimate activity. Thoughts on that?