I don't use Duo specifically but my work has a different authenticator app.

(Duo looks like it requires Play Services but I am not sure on the strict integrity check.)

In my use case, I found it worthwhile to just buy a second vanilla Android normie phone (spent like $200 on a decent but non-flagship device). It has all my required work apps like authentication and the pager/notification app. The phone doesn't have a sim and is WiFi only. In the rare case I need to take it outside my office I just do tethering/hotspot from my primary phone.

I never cross-contaminate work and personal stuff on the same device.