I work for a uni which is rolling out the MS modern auth - we have a FIDO2 option (Yubikeys I guess) for contentious objectors to the Authenticator apps.
Do you hand out the keys for free? If not you are still punishing people who have the moral high ground.