Setting up MFA for RD Web Access and RD Web Client using ADFS

If I understand the requirement correctly, RD Web/RD Gateway already works, external access already uses WAP, and you want internal users to receive MFA without exposing the internal RD Web endpoint externally.

You don't need to introduce a second internal WAP tier solely to make AD FS trigger MFA.

AD FS authentication policies can require MFA globally or for a specific relying-party trust and can make decisions based on users/groups and network location. In other words, WAP isn't the only mechanism that can cause MFA to occur.

I would:

Identify the relying-party trust used by the RDS/RD Web authentication flow.

Create/test an AD FS authentication policy requiring MFA for the required users or groups.

Test it from an internal client before changing your proxy topology.

Leave the existing external WAP deployment responsible for external traffic.

Add WAP nodes only where you actually need proxy capacity or availability.

Microsoft describes multiple proxies protecting the same Federation Service as a proxy farm; they use the same Federation Service name.

So I would not build a second internal WAP cluster purely as an MFA trigger. Configure MFA at the AD FS policy/relying-party level first.