Yikes.
"50+ devices for seminar / display booth / product demonstration use - all will have same MDM profile and are not allocated to specific users"
Why are you using Apple IDs at all!?!? If these units are being used by random people in a public space for demo purposes, then deliver your apps via VPP, hand the units out like candy, and then wipe at the end of each session to reset to defaults.
The only reason I can think of the need for Apple IDs is that your app/product uses iCloud storage and you need an Apple ID to participate in the cloud storage. If this is the case, then consider setting up shared iPad and treat the IDs as students. This will by pass the need for MFA unless you Federate to an identity provider (which would be foolish because you would be granting access to your corporate domain).
But I return to the first point. Why do you need Apple IDs? You are giving strangers passwords or at worst you are maintaining a password list and worrying about MFA (as you stated). But, what if one of your participates creates content in the Apple ID? Wow, what a potential nightmare. That will still be there when the next person uses that ID.
Volume license all your apps in ABM and deliver them to the devices. No Apple ID. Hand the device out with a no PIN code and restrict the ability to create one. Use your MDM to tailor the device by aggressively using restrictions. When the event is over, wipe and reset to make sure no one did something inappropriate on the device (for example, BLOCK the camera if you don't need it for your app - you will be surprised by how inappropriate professional adults can be).
Hope this helps. Unless you are demoing an EDU product or an app that is storing data in Apple's iCloud, avoid IDs like a swarm of bees (reference to when Apple had a sense of humor and posted a Kbase article with this sentence: 'Stay away from the SyncServices folder as if it were a swarm of bees...').