We would like the ability to deploy different 2FA methods for different user groups, while also being able to restrict which methods are available to each group. Currently, for instance, it is not possible to configure email-based 2FA for one group while mandating 'push-to-verify' and/or hardware tokens for another.