Can I turn on two-factor login for my staff but not for my customers?

Yes. Open Plugins → Two-Factor Authentication. There are two separate switches:

• Admin panel covers store admins and staff logging in to the dashboard.
• Storefront (customers) covers shoppers logging in to their account on your store.

Turn Admin panel on and Storefront (customers) off. Each switch saves straight away.

Turning a channel off stops Wcart asking for a code on that side, even for people who had already set up two-factor. Their setup is not deleted, so it works again if you switch the channel back on.