I was totally sharing your concerns, hence my iPhone is forwarding any messages - including those from my bank accounts - although bluetooth on both Mac and iPhone is turned off (and so is wifi on the iPhone, so I assume the forwarding works via cellular data). According to a nice and helpful guy on the Apple-Hotline, there is no such option as filtering which messages will be forwarded and which not.
But after thinking about the issue for some while, I do not see it as such a big deal anymore. The 2-factor-authentication is based on the principle of knowing one information (like your password) and possessing something (e.g your phone) to receive a second piece of information which will, put together with the first bit, act as key. The situation with the message forwarding just differs in so far, that the "thing" you possess in this case are two things (the phone and the mac). So no breach, imho, since the guy who could possibly steal your Mac still has to know your password.
It just does not feel right to have the transaction no displayed on the same device that runs the session and thereby requested the number ;-)