Most email accounts that get taken over had a password that was reused or typed into a fake sign-in page. Two-step sign-in asks for a code or a tap on the phone as well, so the password alone is useless.
Switch it on for the managers first, then one team a week. Show people the app on their own phone, and keep two backup codes for each account in a safe place.
Expect a few calls in the first week. After that, nobody notices it, which is the point.