Definitely set up ssh key that has a password.
https://www.digitalocean.com/community/tutorials/how-to-use-ssh-keys-with-digitalocean-droplets

Here's a guide for two factor
https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04

not quite what i was after, but I've since found authy.com which is pretty much what i'm looking for. My use case was to integrate 2F on the application for the user, not the sysadmin.

Thanks