I don't think there is an easy way to force it on them. You could always do it for them in DA and then send them the scratch code so they can get in and scan the qr code or they could get the list of scratch codes and create more. You could also do it from the command line which requires modifying the user.conf file and creating the two-step files. It could be scripted.