Your organization requires that members of the Finance department use only phishing-resistant methods (such as FIDO2 security keys or Windows Hello for Business) when accessing a sensitive payroll application, while other users may continue using standard MFA. You want to enforce this through Conditional Access with the least administrative effort. What should you configure in the Conditional Access policy that targets the Finance group and the payroll application?