Successfactor two factor authetication outside customer network

Dear Team,

Our client have a SF url and SSO has been already enabled with Azure AD.

Now customer wants two factor authentication for this url when employee try to access the url from outside customer network. Means when the employee try to access this url from office it should be the sso configuration which should work. And when the same employee try to access the url from outside it should two factor authentication.

FYI, we did not configred the IAS in the SF landscape. Performed SSO configuration as general way as mentioned below url

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/successfactors-tutorial

Kindly hint how to achieve this scenario.

Regards,