I solved it (at least TFA):
First of all: We use google workspace for mails and have one “server account” for system mails.
Based on the google smtp relay documentation I added a routing configuration (SMTP Relay Google).
Then I configured 2-factor-authenitifaction for the server account.
In these settings you can add applications with separate passwords, where I added xibo
In config.env add these credentials:
CMS_SMTP_SERVER=smtp-relay.gmail.com:587
CMS_SMTP_USERNAME=[username@yourdomain]
CMS_SMTP_PASSWORD=[theapppassword]
Now TFA works.