Access -> One Time Pin

I am trying to setup Access restrictions.
I have defined allowed IP address access group and email address allowed for Gooth authentication.

The Google authentication seems to be working fine and is allowing only my IP or email, but the One Time Pin allows ANYONE through, it doesn’t care what email address is entered, it send sthe pin and allows them access.