In-tunnel MFA

[lostmythread]

I was trying to determine to what extent I could use defguard to provide VPN access where:

1. Nothing exposed on the Internet besides the Gateway(s)
2. Client performs enrollment on a "trusted" network, i.e. where the Edge servers are reachable.
3. Clients connect to a Gateway in two stages:
   1. pre-MFA: setup base wireguard tunnel using the pub/priv keypairs that were setup during enrollment. User authentication, possibly involving an external identity provider, is all done in-tunnel. At this stage, the Gateway only allows access to DNS, Edge(?), Identity provider.
   2. post-MFA: once authenticated, rules matching the user's/group's/device's allowed destinations are applied. The VPN is operational.

As far as I was able to tell from the code in defguard_core, there doesn't seem to be a provision for routing the MFA flows in-tunnel. Am I completely mistaken, or is there some other approach that achieves the "only wireguard is exposed to the Internet" criterion?

Thanks for your insights!