Citrix NetScalers can be licensed with an AAA module. This module can interact with Azure AD (and AD FS) using claims-based authentication. In the case of federating with Azure AD, Conditional Access can be used to require multi-factor authentication. An NPS Server is not required in this scenario.
The reason why we see a lot of organization take the NPS Server route is because they are migrating from other RADIUS-based solutions like Azure MFA Server and RSA SecurID Access. In these migration scenarios, the RADIUS component is simply switched out. It is a method that allows for easy roll-back. Additionally, the pricing of the AAA module is steep.
Azure Multi-factor Authentication supports OATH-based tokens.
This feature is currently in private preview.