Have any organizations moved their work Apple ID to two-step authentication?
I will say that I have seen two small organizations do this, but the overhead of setting up the escrow of recovery keys took more effort than we are likely to save in three years of supporting the accounts. 


the actual setup went smoothly
people seemed comfortable with mixing work and personal accounts despite the added confusion that it can cause
we didn't run into any roadblocks registering common trusted devices.


Also, now that Volume Purchase Plan redemptions can be reclaimed and they are not lost when issuing expensive apps to personal Apple ID, the need to more tightly control which Apple ID is used to redeem a purchase is not nearly as valuable as it would have been in the cases where we looked at implementing this.

The strategy we are now taking is to just establish a written policy that work apps are to be returned to work - just like work computers and work phones and have employees sign for the tools they are provided with an HR policy to deduct value for tools not properly returned at the end of employment.