You can use pam_succeed_if module (see manual page) for the authentication part:
# the other authentication methods, such as @include common-auth auth [success=1 default=ignore] pam_succeed_if.so user ingroup group auth required pam_google_authenticator ...