Mandatory MFA Enforcement - Client-specific restrictions and challenges

We have a client with very specific work environment restrictions that directly impact their user's methods for accessing Oracle applications.

The majority of the client's user base work on high-security sites; restrictions include:

• No access to mobile phones
  
• No access to personal or work email
  
• Use of shared, highly restricted desktop devices
• Approx. 50 high-security sites with 3-5 x PCs and 2 x tablet devices per site

At present, users log in with username and password; the client has neither an IdP nor SSO enabled and have no plans to do so. Due to the highly restricted nature of the desktop devices, USB / HID devices are not and cannot be permitted.