> SMS may take some tricks (again, iMessage can be useful here).
How would iMessage help? Every SMS MFA implementation I've seen only works with phone numbers. If you mean "have a phone in the office hooked up to MFA and sign into iMessage with that phone's Apple account on multiple colleagues' devices", I've tried that. It technically works, but is flaky (Apple's reasons for forwarding-or-not greenbubble SMSes are opaque, and much less reliable than iMessages, though I'm told that improved recently due making things give up on Continuity and fall back to WAN more often). It also slams into the reality that most people want to use the Apple device that's getting the SMS codes with their personal Apple account, which causes friction.
If you need that capability, it's probably both more reliable and cheaper to use a web-controllable phone number (Google Voice & competitors).