Best practice for using a cloud firewall? Active/Active on-prem/cloud or pure cloud?

Got a small environment with a firewall on-prem but want to look at getting a firewall in the cloud instead, so it has more availability than being physically on-prem. This would also mean the VPN built into the firewall is more available. So if our on-prem got wiped out for example, we'd still be connecting to the cloud remotely, getting the same IPs, seeing the same cloud servers. There are about 500 users so when they are on-site I'm wondering if just having an IPSec directing all traffic out to the cloud firewall would be overkill. Or if I should have a firewall on-prem and a matching appliance in the cloud in a Active/active setup.