securing client web access

Hi, i understand 2FA or client lockout (from incorrect password attempts) is not possible for client web access (which i feel should be a feature) - was wondering if anyone had managed a work around to achive this extra security?