If you add a separate password in order to use the Export option then employees will not be able to take keys offsite and import into a home proton authenticator. They will be restricted to using on premises only. Only the admin sets up the initial 2fa so they never see the 30 digit code or QR that created it. Another needed layer of security.