I'm unaware of a way to prevent login with a 2FA enabled Apple ID. I'm currently having issues with an Apple bug that is triggered with 2FA Apple IDs, and there's been no suggestions from Apple on ways to block them, though I haven't specifically asked for confirmation on this.
Using Managed Apple ID's is one way...
Apple continues to make it harder and harder to create an Apple ID that doesn't have 2FA enabled. You can do it, but it's convoluted, and users are perpetually faced with a badge icon encouraging them to enable 2FA. To set-up a new Apple ID without 2FA, skip Apple ID sign-in/creation during set-up assistant. Skip adding a passcode to the device as well (if students add an easily guessable passcode that Apple deems insecure, the Apple ID set-up process will still trigger 2FA...and most students end up picking easily guessable passcodes). Download an app from the App Store and follow prompts to create a new Apple ID. The screen after they accept the terms and conditions, they should see a prompt to create security questions. If they see this, 2FA will not be enabled by default for that Apple ID. If they do, have them cancel out and remove the passcode they set on the device (because student never skip ahead and don't listen, right?).
