You are a Google Workspace Administrator for a growing startup. The company believes in offering flexibility to its employees but wants to ensure a basic layer of security for all its standard accounts. Which of the following methods would be appropriate to enforce 2-step Verification for low-risk and standard accounts without being overly restrictive?