Looks like it might work if you use their authentication server, you can point to that server in pfSense.
No idea if it will work but it seems you have the choice to offload OpenVPN from pfSense or use it’s authentication.
From a project point of view, presumably you want to MFA for remote access, that is easily done in pfSense, plus with OpenVPN you can easily revoke certs. If your project objective is a must use Duo then you need to support that solution moving forward, for sure more cost. Easier to support pfSense.
I’d be curious to know which path you end up taking.