Consider this scenario; you operate a large research company with numerous locations. You have employees and vendors that travel between the different locations on a regular basis. Now each of these facilities not only uses secured access to enter the main facility, but different areas within. Since only a few of these people need regular access, you will find that using two factor authentication managed at server level can provide the appropriate access when needed and keep those out that are not authorized.
The Right Two Factor Authentication
Since two factor authentication does in fact require two very different and unique forms of identification, you can literally control access at server level. The idea being that using just a username and password is not enough to gain access, but a second separate factor such as an RSA token is required to gain access, you can establish a protocol that only provides the second factor when it is needed and restrict its use when not needed. This makes it possible to grant access remotely without the need for any further security measures.