As far as I know you can deactivate MFA for people but you cannot force that every user needs to enable 2FA. This probably would need a new window for users that don't have MFA after their login so they are forced to enable and least one of the three.