Guardian uses WebSockets to talk to the server. While this is mostly OK with most firewalls nowadays, it might be possible that some policy is actively preventing this communication.
I would check if WebSockets are available in their network. An affected user can record a .HAR file and send it to you to post here (remember to delete any visible password in the .HAR file) or directly use the browser’s developer tools to check if some connection is being blocked when doing the MFA flow.