Might be worth a shot doing an NSlookup from a blocked PC to facebook.com and see what IP you get. Then put the IP in here https://www.iplocation.net/. May help pinpoint the country, if the URL is being resolved by somewhere in an offending GEO-IP range.  ... View more

If you haven't done so already, double-check the security settings of the VPN adapter, found via "VPN > Change adapter options under Related settings." Should be 'allow these protocols" with only PAP selected. ... View more

Considering you have hundreds of locations, breaking them up into physical locations may be a bit of a hassle, but this is probably the best option.   Of your initial two options, I would recommend the first option, especially due to some regulatory issues with AP's being from differing regions but placed into the same network. ... View more