Searching for hardware token returned two whole topics.
Which hardware token flavors are recommended by Discourse?
Those neither on phone, nor requiring google software.
For multi factor authentication? Any that implements the webauthn spec will work. Personally I use the latest Yubikey.