On a mac device, the OneLogin prompt for Office applications will require credentials whether your are connected to VPN or not. Outlook and Teams along with other Office 365 applications will periodically pop up, redirect to OneLogin and then disappear after you type in your credentials.  You will not be required to use MFA while on VPN.

When you are not connected to VPN, you will be redirected to OneLogin to sign in and then prompted for WFAA Duo MFA.  The typical option to select is a DUO Push.

Some applications may prompt to retry authentication.

Here is an example prompt from Teams: