I think I have this cracked thanks to a long call with Apples support. Basically, it goes like this.
1. Log out of iCloud on ALL your devices. You can make sure you've got them all by checking your iCloud account on your browser, you can see all logged in devices in your settings: click on your name at the top right corner, then iCloud settings in the drop-down menu. As you log out, the device should disappear when you refresh the page. If you have an Apple Watch that doesn't disappear, just click it, and then hit the X next to it in the device menu that appears.
2. Turn on iCloud and two-factor authentication on one device (iCloud > then click the bit with your name and AppleID > then Passwords & Security). Use your iPhone to do this first if you have one (best connectivity).
3. Once that's set up, you should be able to log into your other devices one by one and it should come up on your already-connected device(s) that someone's trying to connect from a particular locale (related to the location of the server, not the position of the actual device!). You click allow, and then it will give you a passcode which you type into the device.
4. From what I can tell, there is then a problem that a "Waiting for approval" screen comes up and, essentially, never goes away. If you're on a iOS device, don't hit cancel or that you can't approve, just double click home and swipe the screen away. You're already approved if you get this far, so just get rid of it. You can also do this with a Force Quit on your Mac (you can then go back into your preferences and make sure that your iCloud services are correct... and no, you don't lose the changes you made before you got to this screen if you quit out of preferences this way)... though you may well end up with another "Waiting for approval" screen, you will be able to get things done. I think these "Waiting for approval" messages will go away eventually if left alone, but they take a really long time, and if you have work to do, this strategy seems to work. Note that the top of the pop-leads you to believe you need another code from another one of your devices, but you've already input that and it's waiting for approval from that so you don't need to do anything further. All you want is to avoid hitting Cancel or Can't approve (hence the force quit).
5. If you need reassurance, you can see that you are now connected to iCloud by going back to your iCloud account settings on your browser (see Step 1) and seeing that that device is present. Also, check that your iCloud e-mail, contacts, and other services are where they are supposed to be.
I hope this helps!
