Two Factor Authentication for admin/OAuth2 for REST API
There's no public plugin for this as far as I'm aware of (note, I'm author of the drupal.org TFA module).

I do think it's a quick write, depending somewhat on how your REST API is authenticating the request and particularly whether you create a Drupal session and invoke the user login process.

You can allow a REST call to skip the TFA process very similar to how the TfaTrustedBrowser works. The loginAllowed() method on this plugin (implementing TfaLoginPluginInterface) will be invoked and you can check the request headers/global scope (user UID) and return TRUE to tell TFA to not block the login action.