Thank you for reaching out.
I understand you want to set-up Azure P2S VPN for the Android tablet users. As you are already aware this can be done using Open VPN(SSL) with Certificate authentication and the Android OS has to support TLS 1.2
If it helps as documented here the strongSwan client on Android can use only the IKEv2 tunnel type to connect.
Based on your questions above
How is the best way to generate the certificates for this considering it is required for Android OS? Can I buy one from a CA instead or must it be self-signed?
You can use either a root certificate that was generated with an enterprise solution or generate a self-signed certificate as documented here.
Hope this helps! Please let me know if you have any additional questions. Thank you!
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.