2FA authentification

Please anybody help me. I want to know about setting trusted device base authentification.

Only trusted devices allow to zimbra's webpage per domains, how should I do?

I tried these command

zxsuite auth policy set WebUI domain domain.com 2fa_policy 2

zxsuite auth policy set ZmWebUI domain domain.com 2fa_policy 2

and, I set mobile passwd in AdminPage, and ExchangeAccount was set in my iPhone and secceeded sync, deviceID was found in AdminPage.

I have thought that I could get OTP by Mail which is configured in iPhone.

By using OTP, I can access webpage ,I have thought.

But, this idea might be wrong...

I just want to allow Only trusted PC(or phone or tablet) . Just Trusted Devices.

I dont know and dont need SAML and so on.

Just Trusted Devices.

and Who judge -Trusted-? admin?

I beg your advices.