There is, though it is not ultra granular. They introduced it last year and we mention it in the guide.

https://workspaceupdates.googleblog.com/2019/03/more-control...

Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only.

The middle option for most people is a great one as it allows Google Prompt (push notifications) as well as Google Authenticator style OTPs, plus security keys.