Which authentication flow is the most secure?

I would say 2FA is the most fairly secure way to go. Add to it biometrics for very critical level accesses.

For physical access to high secure areas it would be biometrics combined with access code and card reader. (Who you are + what you know + what you have).

kind of interestingly worded question as they are all really a form of authentication and it shouldn't really matter how you place them if you are using all 3 of them in an authentication sequence.