Maybe we should change the notion that it's difficult to deploy an on prem service.
Why can't it be as simple as containerizing it and presenting it exactly like your would install an app on your phone, with the same possibility to grant permissions? App store provides automatic OTA updates so you don't have to bother about security. And the app itself should not have internet connectivity, connectivity is provided through authenticated tunnel into the container so the app cannot phone home in the background, you can only connect into it using the tunnel with your own password.
Why can't it be as simple as containerizing it and presenting it exactly like your would install an app on your phone, with the same possibility to grant permissions? App store provides automatic OTA updates so you don't have to bother about security. And the app itself should not have internet connectivity, connectivity is provided through authenticated tunnel into the container so the app cannot phone home in the background, you can only connect into it using the tunnel with your own password.