I had seen ones done with HyTrust in version vCloud 1.5.x generation. However, with SAML Federation ... if your Federation server (OpenFS or ADFS) supports doing 2FA, then it might be possible that way.
I assume this is for Tenant Organizations and for the 'System' level (which is vSphere SSO or LDAP only).