You are correct, you can only keep this number and simultaneously get a new number if you give up the plan. There are a few options for you:
You can port your old number to a VoIP service, this will cancel your plan. Then get a new plan with a new number and forward your VoIP service to that.
Or you can get a new number on VoIP and communicate that with your contacts, and forward that to your old number with your current plan. When it is time to dump your old number, port in your VoIP number.
Lastly, you can just bite the bullet and change your number. This might involve some planning and zealous communication, but it is possible especially if you have a known website with your contact information.
For 2fa, using your cell number is actually one of the least secure methods, so I would highly recommend you use an app like Authy instead.
I have actually already set up a Nova Scotia number on VoIP.ms.
I also use Authy for all services where that is possible.
It sounds like I should probably try and move my SMS 2FA to the VoIP.ms number, until nothing messages my 416 number, and then port that into Koodo.
My remaining question is - can I definitely port my VoIP.ms number into my existing Koodo account, replacing and releasing my 416 number?
The short answer is yes, if it is a Canadian number, you should be able to port it from VoIP.ms to Koodo. The longer answer is “it might be a little more complicated than that”, so I suggest you contact Koodo first and make absolutely sure the number can indeed be ported!