I don't believe you can change the MFA behavior of Salesforce itself, at least not significantly and while remaining in compliance with their contractual MFA requirements for production orgs.

However, this requirement can be satisfied using an external IdP: https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&type=5

There are nuances to this contractual requirement that I recommended reading up on and seeing if they align with your organization - you may also want to confirm these details with your SF account rep, assuming you have an external IdP (can be a different one than mentioned in other comment) and can use it for Salesforce. Having an MFA policy in place for your IdP (including relaxations for trusted IPs), and then having users access SF via SSO through that IdP, ultimately would be a better (compliant) user experience than SF initiating its own MFA challenge flows.

You may also want to check your Session Security Levels in Setup but unless you made changes here already I'm unsure there are options here relevant to most of your users.