Can you use the 'free' Office 365 MFA with ADFS - or do you have to use Azure MFA?
You can. If you want the on-prem version though, you need to create a MFA provider in Azure.
Thanks for the confirmation @Vasil Michev.
The MFA provider in Azure - that would require an Azure subscription, right? (e.g. not just the free one with 365)
Yes, but you should be able to get one with the pay-as-you-go type of billing.
You'll need Azure AD Premium licences for your user to do this. Then you can download Azure MFA Server by following this guide.
Here you have a new option that is in preview now "Azure MFA cloud based protection for on-premises VPNs is now in public preview!" - https://blogs.technet.microsoft.com/enterprisemobility/2017/02/06/azure-ad-news-azure-mfa-cloud-base...