How to implement 2-step verification

I don’t think you can do it straight off without messing with the core files.
You can of course do something like Authelia and put it in front of the actual page.