Always On VPN - Device Tunnel

Hi Folks

I just got confused while reading the details of device tunnel in below write-up.

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/vpn-device-tunnel-config

Now, questions in my mind are

1. Hope device tunnel is not only for Infra services like AD, DNS, DHCP,PKI,SCCM etc

2. Is device tunnel only sufficient to access Infra Services (like AD, PKI, SCCM) and on-prem applications (HR, Business apps etc) or do we need to have user tunnel also for applications specifically?

3.Can we use same VPN and NPS server to pass the device and user tunnel traffic and authentication? ( i hope yes with IKEv2)

4.Is there a better documentation of implementing AO VPN end to end for on-prem Infra and application access?

Regards:Mahesh