Currently there is no way to enforce Duo out the gate for new users. You must login, setup Google Auth, enable Duo on your profile, delete Google Auth, and then you can use Duo.