With Azure Active Directory (Azure AD) Conditional Access, you can control how authorized users can access your cloud apps. The location condition of a Conditional Access policy enables you to tie access controls settings to the network locations of your users.
For this question, we need to configure a location condition in a conditional access policy and apply the policy to users in that location (the branch office). The conditional access policy can be required to 'Allow Access' but 'Required MFA'.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition