Add a feature to block selected user accounts from logging in outside of trusted networks. Reason being if I create accounts for wall tablets I don’t want to enable Two-Factor authentication and I am leery of exposing accounts (right now admin accounts) directly to the internet without TFA.