How do you all handle password expiration with Password Hash Sync?

We are moving to PHS with Entra ID but I'm not positive of the best route for password expiration in the cloud.

Seems the options are:

1. Set up a policy in the cloud to match the policy on prem (even though they won't be in sync yet) then once the user changes their password next it'll be in sync.

The issue is we don't allow password writeback so if a users password expires and they aren't near their work computer then they are unable to use their work phone until they change their password. May be a big annoyance.

2. Leave the password policy in the cloud to not expire so the user can still use phone until they change it. Users would still have MFA enforced so it's not just straight username/password.

While convenient this definitely seems like the less secure approach.

I'm feeling option 1 is the best but was wanting thoughts on people that have implemented this already.

Thanks