Email OTP for certain group

Yes, I saw this setting, but this does not prevent the user from using his password to log in.

which plugin ?