MFA and Contracted Users

Hello all! 

My team and I are in the process of trying to figure out how to approach the new MFA requirement for our contracted users. Our normal employees utilize active directory/DUO SSO to meet the new MFA requirements which works well. However, our issue now lies with our contracted employees; we do not put these users into Active Directory nor do we create company emails for them. We would like to avoid setting up salesforce passkeys to keep everything internal. What are my options?