2-factor logins consist of 2 of three things: something you either have, are, or know. Passwords are something known, so you'd have to implement something you are or have. Biometrics, ie "measuring people"; iris scanners, fingerprint scanners, voiceprints, hand scanners, and facial recognition are examples of biometrics that either require specialized equipment, or can easily be fooled by someone with access to a dollar store. So unless you have a human supervising them, biometrics are out.
So that leaves something you have.
A simple and annoying way to do this is to restrict user logins to their computer. Sure, you know Bob's password, but you don't have his computer. So login fails. That's about the cheapest way t o do it. Otherwise you can issue hardware tokens. Then you'd enter your password and the code from the hardware token or have the hardware token inserted into the USB port.
The challenge to doing this via software is having it be something you have or are. Software by definition is generally neither of them.
PS you already know this, but you have a huge problem with people sharing passwords. Effectively you have no audit trail or way to specifically hold someone accountable for what was done under their login. I assume you already knew that...