Any reason MFA can't happen during user logging into the Horizon client rather then connecting to the Linux desktop which is recommended? You lose the ability to do SSO when you introduce MFA on the Horizon desktop in WIndows. I assume it goes the same for Linux.
Here is setting up google 2FA (not exactly what you're looking for)
This is exactly what I am looking for the material is a little out dated. So when trying to follow, the paths are a bit different. I am hoping there is a more updated version similar to this!