Email codes are the simplest second step. When you sign in, we email a code and you enter it.
Turning it on
Open Profile and enable email sign-in codes. There is nothing to install and nothing to scan.
What it is good for
It is a genuine improvement over a password alone, and it takes one click. If your team will not install an authenticator app, this is the realistic option and you should use it rather than nothing.
The weakness worth understanding
Your account becomes exactly as secure as your email account. Anyone who can read your inbox can complete the second step. If your email itself is protected only by a password, you have added less than it looks.
So if you use email codes here, make sure your email account has its own two-factor authentication. That is the more important of the two.
When it will not work
You need to receive email at the moment you sign in. No connection, a mail outage, or an aggressive spam filter all mean no code. There are no backup codes with this method, so if you cannot reach your email you cannot sign in.
That is the main argument for the authenticator app, which works offline and has backup codes.
Using both
You can have both enabled and pick at sign in. A common setup is the app as your normal method with email codes kept on as a fallback.
Turning it off
From Profile, at any time. If it is your only second step, turning it off leaves your password as the only thing protecting the account.