Introduce Mac Address Restriction. As a company we can not ask staff without a company phone to use 2FA. We have staff members who work remotely, whether that be out on site or shows. Even there we can not rely on IP Address restriction, if the server goes down.