Thanks for inputs, we wont be changing sign in frequency, just plan to add Device Authorization and maybe 2FA.
I think most elegant solution would be to have an option to switch from DA to Email and vice versa, then, the one you use will pop up next time you have to login, with ability to switch.
