Use a fixed synched (configurable) Attribute to use for eMail MFA. So that the user is (optional) not able to change that address and the admin is able to define which address is to be used for the eMail Factor.