If the web UI is publicly accessible (which is probably a bad idea in the first place), none of your suggestions are a good idea, imho. If it is only locally accessible, and only you or very few people you trust need access, you could consider leaving 2FA out altogether.
If a lot of people have access, either live with it, or hand out hardware tokens and use WebAuthn, or use a password manager like Bitwarden, which can also store TOTP tokens, because all other "easy to use" 2FA solutions like email, push, SMS, or workarounds such as “Remember me” are potentially insecure.
Alternatively, manage the authentication yourself with an OIDC provider such as Authentik and thus offer your users a secure (or less secure depending on your configuration, you decide) SSO solution.
