AAD should still work with published apps. Once the browser client is full-featured, you’ll be able to do away with the TS Farm.
Yes, if you’re already on M365 then you have AAD in place. There are add-ons to AAD that give you extra security. If you have E3 or higher licenses then you already have the Premium 1 (P1) add-on. This gives you on-prem security + cloud plus self-service password reset. P2 gives you some nice security features: Privilege Identity Management (give acess to a resource for a specified period of time, audited, reviewed, extra MFA…), conditional access (required extra security for certain resources based on time of day, IP location, etc), access reviews, and the ability to have group “owners” manage their group.