Apple does not use email for two factor. If somebody has illicit access to your account they would likely also have it to your email address. If you do not yet have a telephone number (remember, this could be anybody's number), set up an account recovery contact and use trusted devices.
To see, add, or change your trusted phone numbers use one of these methods:
● On your iPhone, iPad, or iPod touch: Go to Settings > your name > Password & Security. Next to Trusted Phone Number, tap Edit.
● On a Mac computer choose Apple menu > System Settings (or System Preferences), then click your name (or Apple ID). Click Password & Security, then add or remove a trusted phone number.
● Using a web browser:
1) Go to https://appleid.apple.com and sign in.
2) Follow security options until you find one letting you change trusted numbers,
3) Click "+" to add a new number (you may be required to verify this number).
4) If you wish to remove an old number, click "-" next to the number.
Similar information for the iPhone can be found here --> Use two-factor authentication for your Apple ID on iPhone - Apple Support
If you had set up an Account Recovery Contact ( Set up an account recovery contact - Apple Support ) you can also get a code that way.