No, two messages is not sufficient to achieve what the WPA2-PSK 4WHS is supposed to do: mutual authenticated key-exchange.
The key term here is mutual authentication. Remember, at the start of the WPA2-PSK handshake we have two entities, the access point and the client, holding (hopefully) the same key, also known as the pairwise master key (PMK). Now they want to authenticate themselves by proving that they are both in possession of the PMK. This is the point of the 4WHS (in addition to establishing session keys).
Now let us consider your suggestion: (1) First party (assume this is the access point, as in WPA2) sends a nonce $N_A$ to the other party (the client). (2) Client responds with his own nonce $N_C$, the access point nonce $N_A$ and potentially some other stuff, and computes an HMAC tag on it using PMK. (3) The access point verifies the response from the client using the PMK. At this point, what can the two parties be sure of?
For the client, the answer is: Nothing! Remember, all the client sees is a lonely nonce $N_A$. This could have been created and sent by anyone. Hence the client can have no guarantee that he is actually talking to the right access point.
For the access point, the situation is slightly better. Since he receives back the nonce he himself created ($N_A$), he can be reasonably certain about the freshness of the response (i.e. this is not a replay), and since the HMAC tag checks out he can be certain that the client must also be in possession of the PMK. (Digression: It is however bad form to use long term keys, like the PMK, directly in your cryptographic computations. Usually one derives temporary keys which are used instead. This is also done in WPA2). Hopefully, this also makes it clear why we need the HMAC tag. It is there to convince the other side that it is in possession of the PMK (and of course to detect tampering, but which is aside the point here).
More generally, in an authentication protocol based on nonces, at least three messages are needed in order to establish mutual authentication. With two messages or less, you would also have to use something like a time-stamp in order to ensure mutual authentication (however, this is non-trivial to do correctly in practice and even harder to model theoretically, see for instance: Modelling Time, or A Step Towards Reduction-based Security Proofs for OTP and Kerberos). Why WPA2 uses 4 messages instead of just 3 I am not sure, however it is similar to the 4WHS in TLS, which also uses the last message to "install" the generated keys.
