You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey

You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey for 2FA? Of course this is only to make it as "easy" as possible for them, considering they'd be moving up from post-it note passwords. But it wouldn't be ideal either in terms of security.