How about providing hardware security key instead? paid by employer in this case would be common.