Sophos Connect VPN, Local Account and Mapped Drives

[CHiLL]

We have configured and starting to test our Sophos Connect configuration - so far so good. It's an alternative to our Microsoft Always-On VPN, which uses the user's domain account to log in and establish the VPN connection. However, when this connection randomly stops working for some people and can cause an issue where it stops the user logging in with cached credentials, saying the domain is not available, despite allowing the use of cached credentials/accounts. This is where Sophos Connect comes in as a backup VPN, where the user can just log into a local account on the device and connect the VPN. This leads me onto my main question(s):

 

Mapped drives - what's the best way to get these mapped for the local accounts? I want to avoid doing it manually on each device's local account, though can't think of how to target just local accounts via GPO/script. Ideally I'd like credentials to be saved too, so the user doesn't have to keep rentering them.