See if you can port the 2-factor authentication to use TOTP tokens (“google authenticator” or similar apps) instead. In that case you can simply distribute the QR codes to each employee via some trusted method (e.g. snail mail) and they can then load the app onto their phone and generate all the needed codes.