Horizon View, Workspace One and 2FA

So I've just finished putting together a Horizon View environment for a large University, and suddenly we now have a requirement from our security team for all new external services to be protected by 2 factor authentication.

I have a few ideas and am first wondering if companies like RSA and Duo will cater for an environment such as ours with thousands of potential users accessing our VDI environment. Obviously we aren't going to issue hardware tokens, but would want a self service enrolment portal for registering your phone. Does anyone do something like this in a similar environment here?

Another idea is to utilise Workspace One. We had VMware demo this recently and this does have 2 factor auth capability with VMware Identify. Does anyone know how much work is involved to extend a Horizon View environment to Workspace One? From what research I've done so far I believe I need to deploy some additional VMware IDM appliances and load bnalance them. Would I be right in assuming that the usual address used for the connection servers get redirected to Workspace One so we get a different App portal? Many of the other Workspace One features would be good for us too but this would be another discussion.

This is a bit of a brain-dump of ideas admittedly but wondered if anyone else here has a similar environment?