We have decided to go with an approach I came across on Spiceworks, whereby it was suggested to setup the VPN as required, then copy the "rasphone.pbk" to the target machines via Group Policy Preferences.
This seems to work well, and can be deployed to %ProgramData%\Microsoft\Network\Connections\Pbk to deploy and All Users connection successfully.
The only downside to this approach (which does not affect us in our use case), is it will overwrite any VPN connections not contained within the new PBK.