I think though it may be better without 2FA to block attacking IPs no matter what the protocol.