Might be a bit late, but wanted to make sure you at least get an answer.
Generally Azure MFA can only be obtained with AzureAD Premium PLan1 (and other SKUs that include this plan) or as a feature of Azure AD B2C.
However, for AzureAD Premium Plan1 and other user-based Azure services like "Azure Information Protection" there are no hosting rights (different to other Azure usage-based services) - meaning that you can not get licenses for this yourself, integrate it in a hosting offering and then sell this hosting offering to end customers. The only option that is possible is that customer gets those licenses directly.
So, my suggestion would be to also act as CSP Reseller - so you can provision AAD P1 licenses for the end customer (provision tthose licenses directly in the end customers own tenant), deploy the services - and, if you are Direct CSP Partner, you can provide the customer with a consolidated bill on licenses & services/integration - and also you can manage all apsects since as CSP you have automated delegated admin permissions on the customer tenant you provision for this. So from customer perspective he still gets a complete solution from a single Partner while technically the model differs a bit from SPLA since now the customer is licensing the products and not the SPLA Partner.
Note that is technically also required that each customer gets their own AzureAD tenant when using AzureMFA & their own AzureAD connect instance for siycing local AD to AzureAD. For integration in a IaaS solution the only direct option would be to use the Azure MFA extension for NPS (RADIUS) - for web-based apps I would recommend to use AzureAD App Proxy to integrate the app into the customers AzureAD and also to provide secure access to the app - AzureMFA ist just a feature you can enable for the AzureAD user account.
