MFA Procedure/Security Recommendations

both or at a minimum login

That was my thought as well.... I was questioning the decision because a cyber security company we work with said VPN instead of login.

My environment is both. Gone are days we rely in one factor as threat vector becomes sophisticated. I guess "they" are thinking of physical security, managed device and there is bitlocker in place hence one factor is risk mitigated.
Each security layer would assumed to fail and authentication is one critical layer which should target higher security level at machine and apps level. Ultimately dependent on risk appetite.

Here is Authentication method strength and security:(source: link)
If you don't want to use Windows hello for business, you could try with hardware token or phone.

Thank you both!

Absolutely for VPN, and maybe for device login.

I would never do no MFA on VPN unless you were using certificate based authentication for the VPN.

If you can also do strong authentication to a device, that is a bonus.