validate OTP on login

So you want the OTP to only allow access to one page? Other page requests will require their own OTP? You might consider using password protected pages, a built in WP functionality. The passwords are not one time though. They are essentially shared passwords, which admittedly have their own set of issues.

I’ve not done so, but it should be possible to alter the page password scheme to be unique one time use. The main problem would be handling simultaneous requests from multiple users.

You could still make use of the “authenticate” filter. To prevent further access, have a JS script on the page kill off the authentication cookie once the page is served. This logs out the user, requiring them to authenticate again before accessing logged in only content.