Did you see this thread? There are few places where this can go wrong…
http://forum.mikrotik.com/t/feature-request-two-factor-authentication/60077/38
If you’re talking about 2FA RouterOS login… I think you need to point the RouterOS’s radius client to use user-manager server, explicitly in config. user-manager users are just RADIUS things, without some RADIUS client using them. See https://help.mikrotik.com/docs/display/ROS/User#User-RemoteAAA).
The RADIUS user database is consulted only if the required username is not found in the local user database.
So… Local users (/users/print) would not have any 2FA applied, since only via RADIUS server (i.e. user-manager) is that possible.
If you’re talking hotspot, the user-manager docs cover that case pretty well.
I don’t have this setup, but AFAIK that how this works.