two factor authentication for Exchange 2013 OWA

Have you considered using a Macro in the VPE that will check the http path, and then use an RSA auth login when it's owa and ecp, and then a normal logon page for anything else? Then you could still have the same branch coming out of the macro for both auth methods, and continue to do the rest of the policy flow.