Hi Sam,
I haven't used Envoy MFA, but I would assume it supports RADIUS as a protocol (as most MFA solutions do). If that is the case, your traffic flow would be:
PC with AnyConnect -> FTD -> ISE -> Envoy MFA [ quite possible -> AD/LDAP ]
In this scenario, FTD would pass authentication request to ISE, which would forward it to Envoy MFA solution. MFA would do its job and authenticate client, on both factors (ISE can either forward entire authentication request or authenticate it itself, can't do one factor and forward second). After authenticating client, MFA would reply with Access-Accept to ISE, which can then proceed with authorization of the VPN client. In this scenario, from the standpoint of your MFA solution, ISE servers are RADIUS clients.
Here is a good article how this is done with ISE and Duo. Here you can find another example on how this can be done (different approach, both have its pros and cons).
Although it is not the same, you can easily understand the concept behing this approach, and replicate it to your setup. You must configure MFA solution properly too.
This is one way of doing things, in which user gets only one prompt, without secondary authentication. You can use that approach too, and secondary authentication option comes with v6.4. You can find config guide here.
BR,
Milos
