Global Protect Config from Outside Organization

[DEBARJD]

We are currently using Global Protect with the Portal and Gateway on the same firewall and interface, using SAML authentication through Okta with forced MFA.  We have a requirement to allow an outside contractor to connect to our VPN for access to a very specific resource.  Their authentication method is going to be unique and likely not use SAML....probably LDAP + CAC card.  What is the best way to achieve this?  My first thought was to create a secondary authentication profile on the portal, then at the gateway assign these users a unique IP range which I can control.  That doesn't seem like a great solution, as the first authentication profile brings up the embedded browser to authenticate to Okta.  Do I create second portal and gateway using a loopback interface on the same firewall and direct them there?  Any suggestions would be appreciated.