Once you have a working Yubikey imported into the admin console, an administrator can go in to the ‘Administrators’ tab in the admin console and associate a Yubikey with an user. Afterwards that user can log in to the admin console with ‘enter a code...
You may be able to use the new ‘aliases’ feature. In the case of AD sync, it would just be a matter of configuring your custom attribute mapping to use whatever attributes (UPN, SamAccountName, a custom field, etc.) are needed.