The bit about not needing MFA for unprivileged local accounts seems out of place in an article about achieving MFA. The bottom section is about why/how Hello with PIN + TPM is acceptable MFA.
If Hello PIN+TPM is good enough to pass a CMMC2.0 compliance audit then that’s what the boss is going to care about. Since it doesn’t feel like that is good enough, further experiments with multifactor (non-OTP) windows login are over in that other thread I started.