Can I Use Two-Step Login for Office 365 on the Web Only?

No. Limiting Two-Step Login to Office 365 on the web would allow an attacker to bypass Two-Step Login's extra protection simply by using a desktop or mobile client instead of web access.

Can I Pick which Office 365 Services Use the Added Protection of Two-Step Login?

No, when it is enabled, Two-Step Login will be required for all Office 365 services.