Enable 2FA only for users who log in using SSO

F.A.Q
1

[3.24 and below]

It is currently not possible to do this level of segregation, when 2FA is enabled for all users it will apply to all logins.