Settings → Security has a Team sign-in policy card with two controls. It's available on every plan, for owners and admins.

Require two-factor authentication

• Team members without an authenticator app are taken to set one up before they can use the admin.
• You need it on your own account first (Settings → Account), so you can't lock yourself out.
• It applies to your team. Clients are unaffected.

Sign out after inactivity

Choose when idle sessions end: Never, 15 minutes, 30 minutes, 1 hour, 4 hours or 8 hours. People get a two-minute warning first, and can keep working.