Update [solved]:
It turns out our issue is the same as what Jo reported regarding RADIUS. Upon disabling "Use the same user name and password for RADIUS and Windows authentication" under Advanced Authentication for each external paired Connection Server, things began working as expected. Hopefully this may help someone else using two-factor authentication who gets caught in the same scenario where everything is configured correctly and still not working.
(For the record, VMware is aware of the issue and is going to get back to us on a resolution.)