As bad as it sounds if you not sure what file you should not be doing it hence “core” files 
But I guess you have to overwrite the packages or files here / Extend them
It might be better to wait for V4 coming out which is soon 
I believe and possible people or built in has a plugin to work with what you wanted.
It’s also been discussed here 2FA (via users & permissions plugin) - Roadmap | Product Roadmap