Check out the login_duo(8) man page. You can specify a failmode configuration option to fail safe (allow access) or fail secure (deny access) if there is a connectivity loss between your servers and Duo's service.