2FA is not currently an option. That will need to be added to the backlog by @Peter-Schmidt will need to add it.
As far as having multiple admins with reduced permission, that is currently possible by setting up admin user rolls and then adding your admins to those roles which each can have different permissions:
We don’t currently have the ability to add additional partner staff members to give them access to all sites and not take up an admin slot, but that feature is in the backlog already here: https://treepl.co/public-backlog-state/request/extra-partner-staff-members