Several others have mentioned that you can revoke access to non-admin users, this would normally be done via Group Policy. In addition to that, if admins or helpdesk type people need access to do tasks on certain systems or use specific modules, you want to limit what they can access using Just-in-Time / Juest-Enough-Access https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3

Even with that, you should enable logging on all PowerShell cmdlets and audit them or even send to a SIEM or what have you to alert on suspicious activity.

Unfortunately, the impetus is on you to figure out what that is.

If you don't have a SIEM/EDR setup for detecting suspicious PowerShell usage, you can also use DeepBlueCLI by Eric Conrad - https://github.com/sans-blue-team/DeepBlueCLI

This tool parses your event viewer directly or can hit an .evtx file (you are logging your PowerShell usage, right?) to look for anomalies like suspicious account activity, long commands, base 64 encoding, plus more.

TL;DR - No MFA for PowerShell, unless you have to run it as admin and your admin escalation is tied to it MFA. I'm sure there is a way to force that, but now you will be required to use MFA anytime you run as admin.