Best practice for service/integration accounts in SFMC Engagement under the updated MFA and security requirements?

Hi everyone,

With the ongoing enforcement of strict Multi-Factor Authentication (MFA) and identity verification standards across Salesforce platforms (such as those outlined in Salesforce Help Article 005321561), how should teams properly configure automated service accounts or headless integrations for Salesforce Marketing Cloud Engagement?

1. Given these evolving compliance and security enforcement guidelines, what is currently considered the best practice approach for non-interactive service/integration accounts in SFMC?
2. Are Server-to-Server (Client Credentials / JWT) flows via Installed Packages completely immune to these UI-based MFA/identity verification restrictions, or are there additional security configurations (like API-only user mappings or specific Connected App OAuth policies) we need to adopt to avoid pipeline disruptions?

Thanks!