Duo for MSP and Microsoft 365 global admin

Situation: MSP managing many Microsoft 365 Tenants.
Many clients with Office 365 only, maybe SMB who doesn’t have a Windows server and maybe use only the emails and the Office applications so don’t really want to pay for AzureAD plan.
We were wondering if there’s any way to protect initially only the global administrator access, without having to deploy ADFS to every single tenant.
How can we manage to protect only the access to the x365 admin accounts with Duo?
Thanks You for your time.