Depends on which type you mean. In its security settings you can have a password, a key file and then a challenge response via a YubiKey or OnlyKey for HMAC-SHA1 Challenge-Response which is sort of OTP but potentially not the type you are considering? It doesn't do a fallback to email or mobile for a second factor but it can use the hardware keys.