So this is always a challenge.
It comes down to personal preference but most of my customers today recognize that most users as of today have a smart device where they can get either a text (even my 85 year old grand parents now use text messages :)) or email or both. What my customers are doing is asking for both email and phone number to text and email the username and password to so you don’t have to open access to email.
The other option is to do what the others were suggesting and either allow access for 10 min for them to get email or when they hit submit and give them a restricted access to get email, but the challenge you have now a days is that people get email so many different ways that you will have to allow access to IMAP, POP3, etc.... so then you will end up having a long list to allow. You also have the few that only use webmail so then you would also have to add access to the web!!!
Again its personal preference but today with technology IMHO I would use option 1. It’s a lot easier to deploy and maintain. :) Of course you will always have those few that big fat brick phone that wont support anything but sending a signal into space, but today they are far and few.