Like sure, you could ship a router, firewall, IPS, WAF, et all. But if you're not stopping outbound, controlling clients ability to talk to each other, and blocking things like UPNP, then you're still basically on an untrusted network.
Your options are basically make the network unuseable or mark it untrusted.
At that point you might as well just force all traffic through a VPN.
Like sure, you could ship a router, firewall, IPS, WAF, et all. But if you're not stopping outbound, controlling clients ability to talk to each other, and blocking things like UPNP, then you're still basically on an untrusted network.
Your options are basically make the network unuseable or mark it untrusted.
At that point you might as well just force all traffic through a VPN.