It is usually called two step authentication, and in security circles, it's not considered 2FA. The reason is because the three factors of authentication are "something the user knows", "something the user has", and "something the user is". Email cannot be considered "something the user has" because to login to the email address, typically all the user needs to know is another set of user name and password (unless your company already had 2FA on email).
Many systems, esp. financial institutions and now Google, FB, Twitter, Microsoft Account etc., will use a phone number because the user has to prove they are in possession of the phone.
2FA is often going to be worse login experience than single-factor, but it comes down to what's at stake. If its high business impact information (such as sensitive data, ability to make financial transactions, customer PII), typically 2FA will be favored over user experience.
Having said that, security is as good as its weakest link. So even after you applied 2FA (or two step verification) for users, if the underlying data was accessible in some other way without that additional security, then it's really an annoyance for the users (and yes, I have seen examples of people trying to do that!)