Exchange 2016 mfa for activesync/mapi

hi. is it possible to implement MFA for these virtual directories? 

i've been able to do it for owa, but is there a way to do it for mapi/activesync as well?

also, i have noticed that if i don't do any site publishing rule, the url flows through the fortiweb. for example if i didn't set any rule for mapi, i can go into mapi directly into the exchange server. only after i setup a rule, i can get the fortiweb to filter the traffic. so is there a "block until i say otherwise" rule i can do?