Better Unauthorized Login Denial

I don't like that the only way we really have to prevent unauthorized remote access users is through AD Groups & Themes.
I also don't like that the method above will still allow an unauthorized user to sign in AND register their MFA, and once they try to sign in, THEN they are blocked from getting on the landing page.

We need a better way to stop login at first login. Because as it is, a hacker sign in a register their MFA. That is not a good thing for security (Tested on 19.3.1)