I have heard back from the team on this. Please see the below:
The expiry of the OTP is always 5 minutes and it is not configurable at this time.
The number of tries the verify OTP allows is not configurable but is something currently being developed.
Please let me know if you have any additional questions!
Thanks,
Mary Beth