In messing around with this a bit more I'm going to answer my own question here in case anyone is looking to do something similar.
As stated in the original question, our main requirement for this was to have as little end-user interaction as possible. Many of the clients we deal with are extremely weary of technology and even the mere mention of certificates is already too much. Our goal was to be able to provide a client with a single file they could double click and then use that for SSL VPN authentication.
So in order to do this, request a certificate with your CA, in our case a Windows Server running Microsoft certificate services, and then sign that certificate. Next you need to export that certificate with its private key included, so don't forget to make the private key exportable when you create the request. Next issue the certificate, but you can't simply export the issued certificate directly from certificate services. What you need to do first is export the certificate and then import it into the local certificate authorities certificate store (User/Machine - Personal Store). Then you can export it from there with the private key included and hand that single file to the client to double click and import into their certificate store.
