Allow per-group (or "either/or") Default MFA Method instead of a single global default

Use case: In our organization, we have two distinct user groups regarding MFA hardware:

• Users who only have a company mobile phone (no hardware security key) → best suited for TOTP.
• Users who only have a Yubikey (security key) and no company phone → best suited for security key (FIDO2/WebAuthn) authentication.

Problem: Currently, only one single Default MFA method can be configured globally. If we set TOTP as the default (since most users have a phone), every user who only owns a Yubikey is still forced to enroll a TOTP/OTP method first, even though they will never use it and only rely on their security key. This creates unnecessary enrollment overhead and confusion for Yubikey-only users.
Feature Request: It would be great if the Default MFA method could be made more flexible, for example:

• The ability to define a Default MFA method per group (e.g., "Phone users" → TOTP, "Security Key users" → Yubikey/FIDO2), or
• An option to configure MFA enrollment as "either/or", so that a user only needs to enroll one of the allowed methods (TOTP or security key) instead of being forced to always set up TOTP as a mandatory fallback.

This would greatly simplify onboarding and MFA management for organizations with mixed hardware setups (phone-only vs. security-key-only users).
Thanks for considering this!