I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state"

I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state", only "handshake happened X seconds ago". If there's no traffic, there's no handshake.