This is a solved problem, but a detail not in any docs I could find and I could only get answered from support. Figured I'd add it to the index.App-specific passwords are not supported with Managed Apple ID created through Business Manager. You will simply not see the option to create an app-specific password even if you do have two-factor authentication turned on.