It's good to let user choose their notification setting.

User should have also permission to choose setting for their two factor option. I'm not using two factor for this cause.