Replace Spring Security Login with OTP Verification

I have a following tables

User table

    -username
    -password
    -mobile

OTP
    -mobile
    -otpCode
    -expiry

WebSecurityConfig

http.authorizeRequests().anyRequest().hasAnyRole("ADMIN", "USER")
    .and()
    .authorizeRequests().antMatchers("/login**").permitAll()
    .and()
    .formLogin().loginPage("/login").loginProcessingUrl("/loginAction").permitAll()
    .and()
    .logout().logoutSuccessUrl("/login").permitAll()
    .and()
    .csrf().disable();

When I attempt login. Spring Security checks User table for username and password. My Use-case is login screen is customised to send otp and Authentication should happen in this flow

1. Check Username from User table
2. Check otpCode for corresponding user's mobile in OTP table
3. If matches flow should complete successful authentication.