AD Auth when machines change hands frequently, no DC connectivity - options?

So my company has deployed about 200 HP and Lenovo Windows 10 tablets to field staff for a proprietary LOB app that only runs on Windows. Everything generally works great, but we tend to run into a lot of account-related issues (new users signing into a tablet when there's no AD/VPN connectivity). This project was started and the current 200 tablets were deployed before I started at this company.

Tablets are often changing hands, and the workers are often onsite (in very remote areas), so internet and VPN connectivity is barely an option. As a result, when Bob goes off shift and gives his tablet to Jim, they're often just sharing each others passwords. The whole thing is messy and not terribly secure. All they need to do is launch a simple EXE app and run Outlook (and send emails as themselves). The whole workflow is very kiosk-like.

We're looking at developing Android/iPad apps in the future, but that's a year or two out and doesn't help us now. We're needing to deploy another 20 tablets in the next month and I'd like to avoid even more headache.

I'm curious what you'd all recommend...? Part of me thinks just create a local generic account and just put a shortcut to the EXE app and Outlook webmail on the desktop... I've been looking at AzureAD (we're on O365 already)... so that's a start, but I have no experience with it. I'm also not sure if that works the way I think it does (a new user can sign into a machine and it authenticates against Azure).

What do you all think?