The tunnelers are your friends there. We have them for all major desktop/mobile os'es. They are "basically a vpn client" but with all the actual zero trust goodness you'd expect...strong identity, policy based security etc. We realize you can't just embed zero trust into all your apps right from the start. it's a journey! :)
If you're looking for alternatives you might find the free, open source project I'm a dev on interesting too. you can run your own network if you want. Give us a peek? https://openziti.github.io/ If you like the project just give us a star on github so we can spread the word :) Right now we also have "a single controller" but you don't lose any network traffic if you have to restart it and of course - we are right in the midst of going "distributed controller" to eliminate that spof.
You should check them out. Lots of videos showing interesting features over on youtube too if you like a video... https://www.youtube.com/channel/UCAsrfQasdZmp2Gq07Ej_5cQ/vid...