The notification authentication backend should be able to be configured as "audit mode" in which it sends notifications as normal, but timeout or errors are only logged but do not fail authentication. In this mode, only an explicit deny response should stop authentication (of course an approve response still approves it).
The plan is to use this to test as we roll out 2FA to more users without completely blocking access for users that haven't configured it yet.