From a pure security standpoint I wouldn't regard this as 2FA (which is traditionally defined as "two of something you know, something you have, something you are).
From a practical standpoint I can see some potential issues with this in an enterprise setting. In many companies login to applications is tied to Active Directory sign-in which is also used for access to the e-mail system, so an attacker with access to the users account username/password would likely also be able to get access to the token.
Even if they're not formally linked a lot of corporate users in my experience will practice a kind of informal single sign-on where they manually sync up their passwords for all corporate systems, so again an attacker with access to one will get access to the others, bypassing your 2FA.
If you consider another likely attack scenario (malware on the users PC) again it would bypass this requirement as it would be possible to access the users passwords for the application and e-mail service using a keylogger.
So in summary, I'd say that of your two options this is more an additional inconvenience in return for little gain. If the risk profile of the application justifies 2FA, I'd look at full 2FA style solutions (e.g physical tokens or biometrics)
