Admins, how are you managing your login IP allowlist (soon to be mandatory)?

Hey admins, 

Based on the upcoming mandatory change to enforce an IP allowlist for MCE access (

1. Changing to "Log Allowlist Violations" mode so new logins are added to the Access Log, and then reviewing and adding IPs to the allowlist as users log in naturally?
2. Notifying all of your users that they need to provide their IP(s) up front?

Both seem a little clunky so I'm curious how other admins are approaching it - particularly enterprise orgs with a lot of users (I have over 80 users and didn't qualify for Salesforce's auto-generated IP allowlist recommendations, which is limited to orgs with under 100 IPs). 

Thanks for your thoughts!