It breaks down to how complicated a deployment you are comfortable with, what kind of failures you think you are likely to experience and how much money you have to spend. A single DAG in your will likely be less expensive (less servers), simpler to manage but somewhat less resilient if there is WAN failure. With multiple DAGs you may be able to provide better service to both the main office and remote people but it might not amazingly better. It depends on how things go wrong and also what level of service people can live with.

If your main office loses all connectivity and you can only send/recieve internally, is that still useful? Maybe, maybe not. At that point is it better that the other 200+ users could have full service?

I'd actually lean towards putting the witness at the main office based on your description. If you were more spread out maybe the Azure option makes more sense.

Also changing the witness is straightforward, so you aren't stuck with your decision forever.