As an alternative you could set up 2FA on their google accounts, and then they can have a 2FA app on their phone (not just google-authenticator, any app you trust can be good).
Then they would have a fixed place where they can find the 2FA code and not to mess around with the notifications. It's more complicated but more robust as well.
Then they would have a fixed place where they can find the 2FA code and not to mess around with the notifications. It's more complicated but more robust as well.