Basically all of them? Even the DOD Iron bank / repo1 has non CAC modes behind an auth provider. They have forced 2FA on from what I can see now though