Cloudflare Access would be the simplest solution imo. You just add their email address to the whitelist and have them access the site, they’ll have to enter their email and then they will get a one time code sent to their email which then they could authenticate with.