[Freeipa-users] MFA authentication for some service only?

Hi, I ran some tests and was able to enable multi-factor authentication.  What I have is a Fortinet firewall hooks up to LDAP on FreeIPA for VPN login.   By turning on MFA for an user, when the user SSH to a Linux host, the MFA is required also.   Is there anyway to have MFA on VPN but not on other services such as SSH? ThanksW