Baloo is right, but you don't need to uncheck "Automatic account activation after creation".

Also you can just choose how to use phone

1) for account verification only - then you need to set "Account is confirmed when" option to "phone is confirmed" or "email and phone are confirmed"

2) for 2FA - then you need to just enable "Enable 2FA" option

3) for both 1 and 2

User will be required to enter mobile phone on second step upon join if you decided with 2nd or 3rd option, or on phone confirmation page in case of 1st and 3rd option.