Jamf Connect can do that. Unless I am missing something in your request?
However, be aware it will introduce a two prompt situation, assuming you are using FileVault. The user will authenticate at the FileVault unlock screen to unlock the drive. Then user will be prompted for their username and password and 2FA to login in to the computer.