Windows Remote Desktop Gateway

There is a terminal farm consisting of a connection broker, a remote desktop gateway, and two remote desktop session host servers. Is it possible to install a Credential Provider on the remote desktop gateway server and how to configure it so that a one-time password is requested only when connecting through the gateway, and through the broker without a one-time password?
Or how can you exclude certain subnets so that you don’t have to enter a one-time password if the user logs in from the internal local network to the terminal server?