The UserCheckController only performs one task, which is checking if we can respond to the two-factor authentication if it's enabled. I suggest using an invocable controller, like this:
class UserCheckController extends Controller {
public function __invoke(LoginCheckUserRequest $request) {}
}
I also prefer to extract the business logic to an action (sometimes referred to as a command bus), for example Actions\CustomerPortal\HandleUserLogin. This provides better organization by placing it under the CustomerPortal namespace.