Managing groups of Windows client PCs without Active Directory still hasn't reached feature parity w/ Active Directory. I do not welcome going back to the "herding cats" days of "workgroups", personally.
Azure AD and Intune is good enough right now if you don’t need local servers for apps, and very cheap (or maybe free) depending on what you buy from Microsoft. It can secure a device, apply ADMX files, install applications, and if you need more complexity then you can run PowerShell scripts. It’s not really user friendly, but AD and GPO never really was either.
