"Where would users get their NWC string from though when they start out? " -- look at the current NWC onboarding flow that Damus uses with CoinOs, or Jumble.social uses with Rizful.com -- very, very fast and easy for users.....
Layer 2: Regarding offline payments I would defer to the LDK team.... the most bulletproof solution is similar to Alby Cloud or Greenlight, where the node "runs in the cloud" but has a separate secure signer....