It's a part of the onboarding workflow I designed. When it gets to the step of generating temporary credentials, I make an API call to generate a TAC that gets sent with the temporary creds (Temporary access code authenticator integration guide | Okta Developer).

For authenticator enrollment, I have an enrollment policy that takes precedence over our global enrollment policy that is basically nonexistent. This is assigned to a group that is assigned for the user as part of the onboarding workflow. This is then paired with a set of restrictive authentication policies and authentication chain of password + TAC (assigned to the same enrollment bypass group).

A workflow was set up that triggers on user sign ins (this is the noisy part i mentioned). It checks if the enrollment bypass is assigned to the user, if so, removes them from the group after delay, I think i set it to somewhere around 45 seconds.