real-world SSPR authentication small enterprise

About 500 active users. Office 365 E3, security defaults, no entra premium, no conditional access, no intune. Want to implement SSPR. We are not in a high risk or highly regulated industry. Is Microsoft Authenticator as the only authentication realistically acceptable here? I have read some and opinions seem to be mixed. Yes I understand if is very unlikely that someone would steal a user’s unlocked phone, or that the phone would not have PIN and/or biometrics enabled. These are personal cell phones and I don’t believe I have a way to enforce that (without additional software). I was thinking authenticator + alternate email, then I think about the number of people who will have lost access to the account. SMS seems a bit pointless if they already have the phone. For execs/finance/hr i am thinking not use SSPR at all, or give them hard tokens. What do you recommend? Thanks