How external users can setup 2FA ?

**Describe your question/**
How external users can setup 2FA, when they're not forced to do it at the enrollment stage ?

**Version and Deployment :**

- authentik version: [2024.10.1](https://goauthentik.io/docs/releases/2024.10)
- Deployment: docker-compose via portainer

**Additional context**
I'd like to use Authentik to setup Apps for B2B clients (business owner and their employees will require access to the app), and if possible, I would like to centralize all my clients on one Authentik and not having hundreds of instances, also not wanting any of the users to see all the Apps available in my Authentik so I thought Internal users was a no go, but maybe there is a work around or a setting I ignore...

Idea : Authentik 1 -> Client 1 -> App 1
Authentik 1 -> Client 2 -> App 2
Authentik 1 -> Client 3 -> App 3 & 4
Authentik 1 -> etc.

What I'd like to avoid is :

Authentik 1 -> Client 1 -> App 1
Authentik 2 -> Client 2 -> App 2
Authentik 3 -> Client 3 -> App 3 & 4
Authentik 4 -> etc.

EDIT : I'll use group to handle the app access and setup all the users as Internal so they can setup the 2FA afterward.