Turned out I don't even need an internet connection, banking card or even mobile number of the required ("destination") country. Only prepare a email you never used for creating AppleID. On iOS device (iOS 11.3 as an example):
- Sign Out of AppStore: Settings > iTunes & App Store
- Sign Out of iCloud: Settings > (your username) > Sign Out in the bottom of the screen (!--this is key to being able to create new account in the next step)
- AppStore > find any free app > tap Get
- In menu {Use Existing AppleID | Create New AppleID | Cancel}, choose Create
- When registering:
- enter any legit address as Billing Address in the country
- use whatever mobile phone number you have; it can be your home country mobile
As a result you get AppleID with 2FA already activated on it.
On a downside the wallet in your original AppleID will lose all the credit cards; some apps seem to reset previous authentication (eg Instagram asks for OTP upon reinstallation, which it normally doesn't). Other data loss can also potentially happen.
Translated from macdigger.ru, with a bit of my experience re signing out of iCloud and choosing verification mobile phone.