Note that you must first create a two-factor authentication service for the Sophos.

Click on Remote Access, SSL. And the New Remote Access Profile. Give the profile an name. Under Users and Groups, click on the Folder icon to bring up the list of groups. Grab the the Radius users group (or whatever group you want) and drag it to the Users and Groups box. You can also select or add individual users. Under Local networks, click on the folder button and grab the network you want and drag it to the Local networks box.

That should be it. If you haven't enabled the User Portal, go under Management, User Portal and set the status as on (green).