I'm struggling to disable the self-service password reset to the tenant users. When trying to do a password reset they are asked to verify/enroll 2FA using a phone nr. and a verified e-mail(I want to disable the personal e-mail verification too). 
After successfully verifying both steps they can reset their password. The setup in Azure AD for password reset is as follows:
