Always On VPN Device Tunnel Deployment via SCCM?

I see the instructions located here to deploy a user tunnel via SCCM.

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections

How would you go about deploying the device tunnel?

When deploying manually it required using psexec to install the profile as the local SYSTEM account.

Also, can the VPN profile wizard be used in the GUI to deploy either/or user/device tunnels instead of generating xml files and using the packages to deploy and execute the profiles?