I set up something like this [1] in the past. It relies on pam letting in the user if and only if that user provides the generated number. Do note that messing up pam is easy and may lock you out, so have a backup/snapshot, rescue shell or an open session when you are configuring it.

[1]: https://ubuntu.com/tutorials/configure-ssh-2fa#1-overview