Recommended SSL cert for SSL inspection

[sbluck]

We are about to install HA 600E's and will be doing web filtering (including SSL inspection), and we will also use the 600E's for SSL VPN. We will buy certs rather than relying on the default self signed. Most internal devices will be domain joined and so have the cert deployed via GPO with the exception of BYOD devices. 

I'm wondering what level of validation is recommended -DV, OV, or EV?

Given past experience I'd like to avoid the need for intermediate certs so has anyone had experience with a CA/cert that doesn't have a requirement for intermediate certs?