I had a similar problem.
The solution I found was:
create an authentication stand-alone lib
use authentication lib in the pam module
to create a custom NSS plugin (from this https://github.com/donapieppo/libnss-ato ) and check with the authentication lib to see which local user accounts to map to (e.g. : "ftp_restricted_user" or "...
Ubuntu 18.04 and higher use a more strict sandboxing config in systemd which interferes with google-authenticator.
Simply edit /lib/systemd/system/openvpn@.service and remove this line:
This is a newer feature of systemd that makes directories with 'user' content in them appear empty, for example /home, /root, and /run/user