Azure makes an on-prem server that can be used for on-prem MFA. This server does not require an Azure subscription, but it does require an Azure account and gives ala cart pricing either per-user or per-authentication. So, you do not need a subscription or a tenant.
Also, AD FS has a adapter model that enables third-parties MFA providers to work with AD FS. This is how Windows Hello for Business uses MFA for on-prem deployments. You can integrate third-party MFA providers to give a variety of MFA choices.
Mike
