There is really no "correct" answer that we can give. You need to understand the risks and impacts in order to make a sensible decision. Only you can do that with an understanding of the value of the data and the cost of a breach.
Having said that:
- Using userid on its own would give no real security and it is common for a system to remember the userid in use via a cookie for the convenience of the user.
- Requiring password input to reauthenticate would be the minimum requirement I would think
- Requiring 2FA after a timeout is more secure but likely to get your users leaving in droves! Even many banking apps don't require that. However, again, it depends on the settings you are using. If timeouts are reasonably long then requiring 2FA may be fine. If they happen after 5 minutes of inactivity, that is not likely to be acceptable to users.
So think about the risks and the impact if risks are realised. Think of the value/cost. Not just about the user experience.
Also don't forget that you could get more sophisticated. For example, if your timeout is set to 15 minutes, perhaps you would require re-entry of the password during the next 15 minutes but if the user hasn't responded in 30 min lets say, you might require 2FA.
Also don't forget to add more significant impacts if someone fails to log in after a number of attempts. Generally it is sensible to start by preventing further attempts for a short while with the time increasing on further attempts up to a full lock out requiring administrator input after some number of failed attempts.