Hi,
have any body running cntlm and have replaced this with vyos proxy config?
what is cntlm you can read here
px is the newer version
How to survive behind an enterprise proxy 
To let vyos surfing internet under a porxy with active directory auth ?
vyos should connect to the enterprise proxy with an service account. i mean the correct wording is upstream proxy.
vyos is configured with a transparent proxy, every device behind vyos needs no proxy configuration.
vyos has configured an upstream proxy that use a service account to authenticate to the enterprise proxy.
Works like a simple nat router hat home.
cntlm and px make only the authenticate between the enterprise proxy and use a service account.