It's impossible (other than mutual TLS) to do mfa on the native ios mail app without trusting a third party for one of your factors. Hopefully Thunderbird will support it...