Hi Karl,
You should be able to get started with this devcentral article https://devcentral.f5.com/articles/v11-irules-intro-to-sideband-connections.
The theory would be to create a POST using the sideband connection in an iRule.
I would suggest using an iRule Event in the APM Policy after the logon page. You can either use the checkbox value in the iRule to see if you want to send the OTP message or you can key off the session variable and take a different branch if they want to use OTP (where you will fire the iRule) or not.
You can use this article as a reference as it describes using checkboxes on the logon page and working with the value in an iRule.
https://devcentral.f5.com/articles/add-outlook-web-access-login-options-to-the-apm-logon-page
I believe in 11.5 checkboxes were introduce in the logon page config screen so you will not have to do the advanced customization described in the article to get the checkbox to show.
Please let me know if you have any questions or if you have trouble with the code and I will see what I can do to help.
Regards,
Seth Cooper