I have recently used the new:
Run Company Portal in Single App Mode until authentication.
Works fine, but when I enable MFA, and the user hasn't done the setup procedure on a previous device. They are not able to continue since they can't or set up their Authenticator.
Read this for info: