If you're going to do mandatory 2FA (which I agree with)
WTF.
Why would you agree with such a thing?
Some of us don't run computers infested with spywares.
Most/all banks and brokerage sites I know of do not require 2FA for their users. It is always optional.