RSA Only for external access (UAGs)

Hello

We have 2 UAGs and 2 Connection Servers, both linked.

I want to know if is necesary to enable RSA on Connection Server linked to the UAG to enable RSA authentication for external users. Internal users don't have to use two factor authentication.

Is there a way to configure RSA only in the UAGs without enabling this feature at connection server level?

Thanks!