// migration file
public function change()
{
    $table = $this->table('users');
    $table->addColumn('two_steps', 'boolean', [
        'default' => 0,
        'null' => false,
    ]);
    $table->update();
}

// src/Authentication/DefaultOneTimePasswordAuthenticationChecker.php
declare(strict_types=1);

namespace App\Authentication;

use CakeDC\Auth\Authentication\DefaultOneTimePasswordAuthenticationChecker as CakeDCAuthentication;

/**
 * Default class to check if two factor authentication is enabled and required
 *
 * @package CakeDC\Auth\Authentication
 */
class DefaultOneTimePasswordAuthenticationChecker extends CakeDCAuthentication
{
    /**
     * Check if two factor authentication is required for a user
     *
     * @param array $user user data
     *
     * @return bool
     */
    public function isRequired(?array $user = null)
    {
        return parent::isRequired($user) && $user['two_steps'];
    }
}

$config = [
    'OneTimePasswordAuthenticator' => [
        // custom checker to skip 2FA by user settings
        'checker' => \App\Authentication\DefaultOneTimePasswordAuthenticationChecker::class,
    ],