The password protection feature, now known as Microsoft Entra ID Protection, is included with a subscription to Microsoft Entra ID P2 or Microsoft 365 E5. Since you already have P2 licenses for your on-premises domain, you should be able to use the password protection feature without any additional charges.
This feature enables the implementation of risk-based Conditional Access to your apps and critical company data. It also includes Privileged Identity Management to help discover, restrict, and monitor administrators and their access to resources and to provide just-in-time access when needed.
Please note that while the downloads for the proxy service and DC agent are free, there may be costs associated with the actual usage depending on your specific configuration and needs.
https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id-protection
https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing