FortiAuthenticator for privileged user MFA

I'm trying to set up multifactor authentication for privileged user accounts.  The more I read the more confused I get.  Do I have to install the FAC agent on every workstation in our facility?  Also, does every user have to authenticate to AD using MFA and the FAC agent, or can it be set up just for domain admin accounts?  Thank you for your help.