After initial factors / Authenticators (OIE) are enrolled to meet the Org requirements a user will no longer be given the option during login.
Typically this could be done via the user dashboard under settings, or if you have some sort of Admin App that can make management API calls and enroll the user into additional Factors/Authenticators.
In the email template a link could be set to this Admin app.