Ideas for secure authorization for office workers?

Question

Web development

Management is afraid of phishing sites that an employee will visit and enter their logins and passwords.
They also do not want to put 2 factor authorization. Authorization by IP is not an option, it changes every day and sometimes several times a day.
The following idea appeared:
On the authorization page, we make a hidden input and a js function that looks at the localStorage auth-token entry, if it is empty, a new key is generated, if the auth-token already has a key, it is inserted into the hidden input. And it is sent to the server during authorization along with the login and the problem.
Next, the admin can click on the "Bind auth-token key" button for authorization. And thus, if the key is different, authorization will fail.
How do you like this way? What are the downsides you see?

Answer 1

If the sites are your own and the users are your own, then why is access only from internal IPs not suitable for you?
Or do you have phishing sites made by some employees to steal the passwords of other employees and everything inside the network? If so, then this is the last problem to be solved by technical means.

Answer 2

Kroilovo!
The WOT plugin in the browser is needed and that's it.