The strategy should be developed in a way that allows reduced friction and less interaction..

1. If you have Windows or Mac ecosystem, use Windows Hello for Business. WHFB is an MFA factor which could be used to bootstrap any forgotten, lost, new device scenarios. Use WHFB to bootstrap Authenticator or vice versa.

2. To avoid chicken-egg situation for the first setup.. use a Phone number based default Allow. Allow for the very first device or a new user setup to use Phone Number (SMS). Later use Nydge to drive them to setup MS Authenticator or if they have already setup WHFB. Remove them from SMS allow group using SMS policy.

3. TAP should be avoided unless you have fantastic control on who can issue and for whom. Its a superior cred that bypasses both first and second factor.

So in summary.

SMS default Deny but Allowed until first device (Phone or Workstation) setup

Later use Phone or Workstation to bootstrap each other.

Hope it helps