HI li,
This is a close application. You can't add code to it. You have to play with the bricks they allow you. As far as I know, the best way it to use RADIUS authentication, which allow a question response authentication. A longer shot is to use javascript in the custom sign in pages.
Regards,
The easiest and cleanest option is to use Radius if the SMS auth app supports standard Radius (so SA will be a Radius Client and your App/Backend the Radius Server)
Other options:
1. If your app supports SAML then it can become the identity provider and SA the consumer (service provider). This will be a SSO type intergation.