Best secure remote access for a 200-user AWS shop in 2026

We're planning our 2026 infrastructure budget and need to lock in a remote access solution. We're a 200-person company, everything is on AWS (EC2, RDS, some EKS). We currently use a mix of VPNs and it's a mess for onboarding and access reviews.

I'm looking at Absolute Secure Access but also see a lot about ZTNA options like Zscaler and Twingate. My main concerns are:
- How well it integrates with AWS IAM or SSO (we use Okta).
- True per-application access without exposing entire subnets.
- Cost for around 200 users, including any AWS data transfer fees.

Can anyone share real-world experience on managing this scale, especially the operational overhead? We don't have a huge security team, so simplicity is key.