If you have a SAML provider like Office 365/Azure AD you could use that, and use its MFA (which lets you enable it per user). If you use the built in Meraki option and you use the Google Authenticator its free ... so is it that much of an issue?
... View more