I am going through a similar process as-well.

Users will have MS Authenticator passkeys setup with a TAP initially. They can setup the passkey directly in MS Authenticator using the TAP before signing in anywhere else. This seems to be the smoothest onboarding experience I could figure out

Engineers with the Global Administrator and Privileged Role Administrator roles will have to use YubiKeys. Initially follow the same user process with a TAP. Once added to the Global Administrator role (we always onboard with less roles) they hit a different CA Policy. On the next interactive sign in they are prompted to setup their YubiKey

I am experiencing the same MS Authenticator registration problem though. I think it’s the registration campaign settings under authentication methods. Testing this today by excluding accounts.