You do have to implement TOTP, just not necessarily RFC 6238. Time-based one-time passwords require a shared secret, a shared time and a time-to-live. The shared secret is usually the key for generating the code, but can be the code itself. The shared time is still needed in mail authentication between the code generator and the code validator. The thing that's usually different is the time to live, but in RFC 6238 it is a parameter, so you can implement mail verification with it and a long TTL.