MFA for Non-Azure accounts

We are testing out MFA in our pilot environment. All is working well and are looking to deploy to production, however one question I have yet to find an answer to is what do i do with production floor users that do not have O365/Azure account?
Our MSP suggested getting those users the $6 license that basically puts their user account in the directory without the Office apps included. However we are talking 4 diff manufacturing facilities each with multiple production departments and a significant amount of users. Those users in some cases are also sharing device AND Epicor credentials to log into MES then their EE Numbers to log in and out of production jobs.

Any suggestions from experiences?