Have you considered https://authenticator.cc/ ?

I realize it is amusing to even consider offloading OTP generation to a web browser extension however, if `$work` doesn’t want to provide you with the correct hardware (e.g. Yubikey, NitroKey, etc.) there are boundary-respecting alternatives