How to perform email OTP before authentication?

Thanks - yes, this is the conclusion I came to too - however then we run into further issues whereby if the AD password is incorrect, it reverts to the OTP login to rectify the password (because the OTP is the last logon form). The only resolution I've found so far is to only allow a single attempt and fail the session if the user/pass fails to auth. Not ideal - but I can't see a way around it.