Two-factor verification on your AppleID helps to keep everything nice and secure. Once enabled, you will need any two of the following to access your iCloud account: The password to your Apple ID, a device trusted in the portal (we’ll trust devices during this process) or a recovery key (which we’ll create during this process). In other words, don’t loose your recovery key! Learn To Enable Two-Factor Verification to Secure your AppleID On The Bushel Blog
CryptoCARD can be used to provide 2 factor authentication. This can easily be integrated into the VPN server for Mac OS X, although it will take a little while to get integrated into Open Directory. However, it’s cost effective and available for OS X.