TOTP tokens don’t meet alot of compliance requirements. You usually need a PIN or crypto device with a dedicated solution.

Like the popular password vault says in the name… 1Password for everything. If everything can stand alone in 1Password, it ain’t MFA.