Questions About EMS and Its Licensing

I have some questions regarding EMS. I want my Remote Access IPsec VPN users to have auto-connect and always-on capabilities.

1. Are there any functional differences between EMS On-Premise and EMS Cloud licenses? Are there any limitations with one that do not exist on the other?
2. Does the EMS On-Premise license come with its own installation package? Is it possible to deploy the EMS On-Premise installer on a cloud platform of my choice (e.g., Azure) without any issues?
3. Aside from the Endpoint license packages, I understand there are also User-Based licenses.

• How do they differ from Endpoint licenses?
• When using a User-Based license, how does EMS Know that the user is using license, how does it identify the user, Is it tied to the AD username?
  
  
  5. Can a User-Based license for a single user be used on multiple devices? Let’s say I have an office with 4 laptops, all using the same AD user to connect via VPN, and all are connected simultaneously. Would a single User-Based license cover this scenario?
  
  6. Do User-Based licenses follow the same package structure as Endpoint licenses? For example, Endpoint licenses have separate packages for On-Premise and Cloud EMS — is it the same with User-Based licenses?
  
  7. Does the EMS server need to be publicly accessible at all times? When a user connects to FortiGate via VPN, do they first connect to EMS to retrieve their license before the VPN session begins?
  
  8. Does the device need to contact EMS for every VPN session, or is the license cached locally for some time? If cached, how long is the license valid without needing to reconnect to EMS?
  
  9. Can I make this type of thing work for Android phones(Specifically WMS Phones), I need this devices to have Auto connect and always on as well, with user-based or endpoint based licensing will I achieve this?