You should setup Web Application Proxy (WA-P) to handle the authentication mechanism as the iOS devices don't have cached credentials capability since they are not domain devices. So when a user hits the SharePoint On-Prem site, they are prompted by WA-P for credentials and then WA-P would securely handle the authentication and then handoff the content rendering to SharePoint server.
It would require some SharePoint admin efforts, but overall it's a very rugged , secure, tried and tested solution to handle BYOD issues.
Web Application Proxy is basically a simplified TMG Server; it’s without a lot of the functionality TMG Server has but on the plus side it gives a real quick way of setting up a reverse-proxy for a web application like SharePoint. There’s no firewall functionality as before outside of what comes with Windows Server by default; the beauty of this role is its simplicity.
Web Application Proxy has two modes of authentication for authenticating against whatever web-app you’re publishing; pass-through and ADFS. The principal is the same though; it’ll act as a safety buffer between your internal SharePoint systems and the outside world as no traffic will reach SharePoint unless it’s been authenticated 1st.
Overall, the flow would be something like below:
Publishing SharePoint with Windows Server 2012 R2 Web Application Proxy
SharePoint Server and Web Application Proxy – continued
SharePoint repeatedly prompting iPad users for credentials
Authenticating to SharePoint from iOS devices