Do I need to turn Two-Factor Authentication on for both phone and email?

No. You can use either phone or email, or both.