Found it. There's a list of role permissions that would require a user to have 2FA enabled From: https://system.netsuite.com/app/help/helpcenter.nl?fid=section_1515446005.html

Access Token Management (for Token-based Authentication)
Two-Factor Authentication base (permission to designate roles as 2FA authentication required, and specify the duration of trusted devices for those roles.)
Set Up OpenID Single Sign-on
Set Up SAML Single Sign-on
Integration Application
Device ID Management