If for some reason, it is not possible to download tokens at all, either automatically or manually, then the last option is to export tokens from the admin or service console & import tokens into users' computers. 

Tokens can be exported from the admin console by the administrator or from the service console by the users themselves. 

Export a token from the admin console (by the administrator)

Export a token from the service console (by the user)