Enabling MFA for accounts of different licence levels

Moe_Kinani  thanks Moe , ive read the article and it has lots of useful info but im still not completely clear on a few things

-  it seems it is not possible to use security defaults for the just E1/A1 users and CA for E5/A5 users as it is a blanket setting across the  tenant BUT does that apply to all conditional access policies or just CA policies that pertain to MFA?  

- is there any way to omit certain users, like service accounts or other users that couldnt interact with MFA?

The old baseline security policies method used to have the ability to exclude users (but that was removed last year), it seems crazy to have a tenant wide setting like this & security defaults without any degree of exclusions allowed. It essentially means it is only really useful for smaller organizations with less complex environments yet very large organizations  would like be in more need of something like this but couldnt justify the expense of upgrading licences for large volumes of users just for a single feature.