You can require VSA users enter a 2FA passcode before launching a remote control session from within the VSA console. Entering this 2FA passcode is independent of whether the machine itself requires 2FA to logon.
Note: 2FA for Live Connect sessions are set separately from other remote control sessions. They are configured using the Manage Agent Groups page.