Same, set up a separate email that I use exclusively for services. Did this as if the app password is hacked, they have access to an account with nothing but notifications.

I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don’t lose the 2fa.

I’ve wanted to go this route, but have had trouble getting Sophos to run on my hardware. Didn’t spend too much time with it as pfsense ran on install. May have to circle back to it and troubleshoot it.