1j See -> Two-factor authentication for Apple ID - Apple Support
”Can I turn off two-factor authentication after I’ve turned it on?
If you already use two-factor authentication, you can no longer turn it off. Certain features in the latest versions of iOS and macOS require this extra level of security, which is designed to protect your information. If you recently updated your account, you can unenroll within two weeks of enrollment. Just open your enrollment confirmation email and click the link to return to your previous security settings. Keep in mind, this makes your account less secure and means that you can't use features that require higher security.“
2) As explained in the document linked above you can register backup telephone numbers to receive codes by SMS text or automated voice message. Any telephone number will work (even a google voice, or Skype or other VoIP number).
3) iPads in business and education are easily managed, controlled and distributed using a managed deployment system. Yes there will be a learning curve, but plenty of schools and business use managed deployments (and not just for Apple devices). Apple offers server software to do this at no charge and most small companies I know who use managed deployments run their own server and manage their devices themselves. I even know some families that use it for their children’s devices so their children don’t have unlimited control of their own devices.
But allowing employees to use personal online IDs with company devices is a recipe for problems. And that goes whether the device is an Apple device, Android, Windows or whatever. Apple is not the only company offer a network lock mechanism for devices tied to personal login IDs.
4) with an AppleID using 2FA, yes either a password or FaceID or touchID is necessary. Since all devices sold in recent years offer touchID or FaceID, most people should find they are not frequently having to enter their actual password in the App Store. I just look at my iPhone or put my thumb on the sensor on my iPad when downloading apps or other purchased content.
5) A telephone number is required information to create an AppleID. Always has been to my knowledge and my AppleID is 20 years old or so. And no, 2FA codes cannot be received by email. They are sent by default as iCloud encrypted notifications, or as SMS or automated voice message as a backup means.
