Google probably does 2 factor better than $smallapp. I'd probably take more than 1 form per report though (I think that falls under "similar systems" stuff you mentioned).
- Only allow one entry per GSuite ID in Google Forms
- Enforce yubikey 2FA on GSuite.
- Issue each captain a Pixel 1 with Google MDM for remote wiping and app deployment.
- Turn off all other apps (Docs, Fi, Photos, etc...) in GSuite.