Although Nautilus implements its own SFTP client code, it still uses the OpenSSH ssh tool under the hood, which is not very programmable when it comes to authentication – i.e. Nautilus cannot easily distinguish local prompts shown by the client from remote output from the server, so it has to look for the literal text password: and assume that's the password prompt.
(The Android app, meanwhile, uses an SSH client library that is specifically meant to be driven via code, so it knows exactly what prompts are being received and when the actual "session" starts.)
You can work around this by manually starting the connection using OpenSSH's multiplexing mode, which allows further ssh invocations to re-use an existing connection. The -M and -S options, as well as ControlMaster and ControlPath, apply here.
For current GVFS versions (1.47 and later), which already use multiplexing internally, you need to specify a particular location for the multiplex socket that GVFS will be looking at:
$ ssh -fNMS "$XDG_RUNTIME_DIR/gvfsd-sftp/%C" user@remotehost
Enter PIN for 'etoken_foo':
$ gio mount sftp://user@remotehost
If the OTP prompt does not show up, omit the -f and -N options to start an interactive shell connection instead, then just leave that shell open in background.
For older GVFS versions (1.46 and older), and/or for interactive ssh invocations, you need to define a default socket location in your ~/.ssh/config file (i.e. the global equivalent of -S):
Host *
ControlPath ~/.ssh/S.%r@%h:%p
Then start a background connection using ssh -fNM user@thathost and the subsequent GVFS mount will automatically use it (and so will another ssh user@thathost).
