Salesforce now enforcing multi-factor authentication—Azure AD has you covered

This article is good for explaining how to implement MFA for Salesforce.  But https://help.salesforce.com/s/articleView?id=000352937&type=1#mfa-supported-factors that specific MFA methods for delivering an OTP are not allowed:

Delivering one-time passcodes via the following options isn’t allowed because these methods are inherently vulnerable to interception, spoofing, and other attacks.

• Email messages

• Text messages

• Phone calls...

For SSO:

With the exception of the options listed above, use any method that is supported by, or integrated with, your identity provider’s MFA solution.

Using Azure MFA and Conditional Access how can we limit which MFA methods are allowed per app as it seems to meet the requirements we need to only allow the mobile app for MFA when users attempt to access Salesforce?