It's possible for the administrator to enroll the users they want to, manually?

And then the enrolled users use only the SMS method to unlock accounts and reset passwords? Without using security questions?