Any suggestions on how I enable MFA for our support accounts?

To explain further, we have some AD accounts which are used by 3rd party support companies (ie not employees) to support our internal applications/systems.  They are purely an Active Directory account ( no e-mail etc), they access our servers, but we want them to use some form of MFA for the VPN and when RDPing to the server etc.  They can't use the likes of Google Authenticator, as it could be a different person providing the support.

Am not sure the best way to do this?

Thanks