You can enable Duo MFA for Outlook/Exchange on-premises but this requires you to get to Exchange Hybrid Modern Authentication. Your Exchange servers remain on-premises (as does your authentication) but you can then use token-based access, conditional access, or ADFS benefits such as the Duo mfa plugin.