This can be simple but there are also a few pitfalls to avoid:
Most of your config changes need to happen in the sshd_config file usually located at /etc/ssh/sshd_config
You already have shared keys running so I will skip that here:
The line you want to pay attention to is:
The caveats you want to be aware of are in limiting who can login and how.
These should ALL be in place to restrict access to as small a group of users as possible:
There are many options you can set here review the man page for the full set of options available.
I would recommend setting up a group just for ssh permissions.
The following flag is also strongly recommend:
This will get the daemon to request a password if the key is not sent/reconigized. You can add the hurdle of OTPW if you like but you are theoretically in an encrypted environment so it shouldn't strictly be necessary. Having looked at the OTPW information you linked the code seems to have last been updated 2003 I would be loathe to use it, without getting some peer review. Secure coding practices and indeed the whole environment have changed a lot since then.