Solved this in a roundabout way, I have setup a script to run after users are created
which creates and emails them the OTP token information. This, coupled with only enabling
Password+OTP in the admin settings enforces OTP on every login, including the first.