The mail server doesn’t support it yet but there’s already a Feature request, see Can we get One-time password for using the NS8 mail server instance
You could install a plugin for Roundcube, so users can login to the Roundcube mail client using 2FA.
Authentik is a nice solution but the apps need to support it.