Options available for MFA for Supplier Portal

Summary:

Client has a requirement for MFA on the Supplier Portal.

It seems we have two options:

1. Use a subscription IDCS and add all suppliers to a specific group while employees will use SSO to their existing Azure
2. Create a separate "domain" on Azure, specific to Suppliers, and have devise a way to ensure Suppliers use that (thou I'm not sure how).

Are there other options that won't require employees to have MFA?

Are there any use cases or high level approaches documented somewhere?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):