Design VPN solution for monitoring of building auotmation

We develop and sell software for monitoring and controlling technical equipment in buildings (ventilation ,heating etc). I need help finding/selecting a good windows hosting (likely a cloud solution from one of the big cloud hosts, Azure etc.) and VPN-solution that fulfills my requirements. Here is the setup: Our software will be hosted on a windows server in the cloud and it needs to access controllers for building automation in the buildings on multiple sites. Some building have a network that can access the internet, others will not. So we need a solution that can share existing switches but provide a VPN tunnel for either through 3g/4g or existing networks. None of the equipment in a building should be able to reach other equipment in other buildings. Requirements bullets: *Find a VM-hosting service that has Windows server (must have servers in Europe) *Find a VPN-solution that works with above hosting service and: -Routers/hardware model to setup at local sites -Each local site should be isolated from each other -Lock down access to that only specific devices at sites has access to central server (router will share switches with existing networks) -Lock down so that connection from central server/network can only access specific devices in site network -Support both TCP/IP & UDP -Not dependent on public fixed IP of sites -Should be able to using existing network/internet connection or provide own through 3g/4g *Price should be resonable (eg. close to VM costs of eg. Azure. Routers max a couple of 100USD for hardware and yearly cost). I will provide the following milestones: 50% When we agree on a technical solution 100% When solutions is successfully tested (which I might need guidance on setting up)