How to join a domain over VPN

I'm not sure I understood your problem well. If I'm guessing correctly the problem is that OSX does not cache your AD credentials, then there is the option in the advanced settings in OSX where you enable Mobile Accounts for AD. This means that OSX will cache the user's credentials when they first login.

Unfortunately I don't have a Mac before me at the moment but maybe this will help http://docs.info.apple.com/article.html?path=serveradmin/10.4/en/c7od48.html

It would depend, to me, on whether there are any servers or other shared resources on-site in each remote office.

If there aren't servers or shared resources in each remote office that could be used independently of a VPN failure then there isn't much point in putting a DHCP server in the remote office. If the VPN has failed then not getting DHCP leases is probably the least of your problems.

If there is some capability for each office to function independently because of on-site servers or other shared resources then I'd strongly consider putting a DHCP server in each remote office. That gives the remote office some ability to function in the face of VPN failure.

Having a single DHCP server also implies a single point of failure but, also, a single point of administration. You'll have to weigh the pros-and-cons of that yourself. For ISC DHCPd or Windows DHCP servers I don't particularly care whether I'm administering one or several. Your feelings may vary.

As long as your VPN hardware (or some other device on each remote office network) supports DHCP relaying you'll have no trouble using a single central DHCP server from a technical feasibility perspective. The address assigned to the network interface of the device receiving / relaying the DHCP requests gets placed into the relayed DHCP request and will allow the DHCP server to serve the request out of the proper scope / subnet.