2FA for Zimbra Admin Panel

I understand that ideally the Zimbra admin panel should not be accessible from outside the private network, but what about the BSP scenario? Then the Zimbra admin panel on 9071 needs to be open from the outside and 2FA there would be greatly appreciated.