security.pam.u2f.control

This option sets pam "control". If you want to have multi factor authentication, use "required". If you want to use U2F device instead of regular password, use "sufficient".

Read pam.conf(5) for better understanding of this option.