Azure AD Authentication Method Policy is not disabling user from Adding MA APP

Click on the link in the portal "Manage migration (Preview)" and you'll see that you probably are still using the legacy settings as the migration hasn't been marked as completed. Work through the migration info in the docs https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-authentication-methods-manage