There are two common algorithms used for this: HOTP (HMAC-based OTP) and its variant TOTP (time-based OTP). Both algorithms use HMAC with a secret and some sort of counter to generate a one-time password.
HOTP keeps a common state for the counter, and TOTP uses a count of (usually) 30-second intervals to do this. For TOTP, since usually a site will accept three codes (the current, the previous, and the following) at any given time, it's important that the device be kept in sync within about 30 seconds, but this is usually not a problem if the user is using a smartphone, even if they happen to be offline (say, because they're on an airplane and only their laptop is on wi-fi).
If you're unsure, TOTP is the best choice here and most common, and it's supported by the most common smartphone apps (Google Authenticator and Authy, among them), it's easy to use for most people. If you're using a physical device which doesn't frequently receive time updates, HOTP may be more desirable, but the use of TOTP on a smartphone is typically easier to use. Both use cryptographically secure generation algorithms, although TOTP is better supported in client apps and doesn't require keeping a counter state, and typically HOTP requires accepting more codes to deal with counter skips, which reduces the security somewhat.
I strongly recommend not using a proprietary company's software and app to do this for you because this means that users have to have lots of random, one-off apps that are hard to manage and hard to switch between devices when they get a new phone. TOTP is easy to handle from a library in your preferred language and the QR code handling is not hard, either.