Site setting enable local logins via email controls the ability to get a login link.
You could disable all other login types to make all users use only otp.
See settings persistent sessions and maximum session age (default 1440 hours)
“User will remain logged in for n hours since last visit”.
If you want to apply these requirements only to some users you’ll need a plugin.