≥ and force Microsoft Authenticator on the (private) phones of both employees and volunteers.
Refuse to use the service until they provide you with a work appointed phone. Volunteers admitedly have a more difficult time with that but as someone else said you can indeed do text/call options.
Motorola for phones. Does everything you need with a near AOSP android. Affordable too. good official support, and good community support with lineageos