The requirement is checked on every request, not only on the password form: from the moment it’s on, every request has to come from a session that completed a second factor. A session without one gets “This organization requires two-step verification. Sign in again and complete it.”
In an organisation like yours the shortest path is a passkey. A passkey sign-in counts as a completed second factor on its own.