I don’t believe it can be disabled, no. Also, no data is being sent to a third party.
Here’s a quick summary of 2FA: Discourse implemented the TOTP (time-based one time password) algorithm. When a user decides to enable 2FA they are presented with a QR code (or a long string of characters). That string is used by an authentication app (like Google Authenticator, Microsoft Authenticator, Authy, YubiKey, etc.) to generate a new 6-digit password every 30 seconds. Those apps are in no way connected to your Discourse site, nor do they have any user info. They simply generate a code every 30 seconds. Your Discourse site also knows what those codes are, so when a user tries to log in, after entering their username and password they’re asked for a code. They check their app, enter the code, and the server checks if it’s the same code it expected.
Does that make sense?