Setup VPN on Server 2016

Hi, We would like to Use Microsoft VPN within our domain.

I dont know where to begain or what I need to do this.

These are the things which we like to do.

1. Assign Certifcate to each user who will be part of a security group (Some user will have VPN access not all users)

2. Routhing and Remote Access server and NPS will be install on different servers.

3. No Private address (e.g. 192.168.1.x) should be save in DNS. Only our IP address should be save in DNS e.g. 172.16.5.x

4. Allow to create VPN template which can be push through SCCM

5. All user account should have Dail-in part already setup for new user.

if anything else i need to do then please let me know.