MFA or similar to Sophos XG console

You can for all User. 

But that excludes the "Admin" User. This user is simply not a User, which can use OTP right now. I would recommend to not use this user. 

For example, my deployments have a lastpass Password with 50 digest for admin + Password Guessing enabled. 

Another approach is to completely block Webadmin for all Ports and use Sophos Central as a console access (with OTP etc.). 

You can for all User. 

But that excludes the "Admin" User. This user is simply not a User, which can use OTP right now. I would recommend to not use this user. 

For example, my deployments have a lastpass Password with 50 digest for admin + Password Guessing enabled. 

Another approach is to completely block Webadmin for all Ports and use Sophos Central as a console access (with OTP etc.).