TOTP has some limitations which make it not as secure as the better hardware-based approaches. For example if you get fooled into trying to login to a phishing site and the real site uses TOPT, all the phishing site has to do as ask you for the TOTP code. TOTP in this case only protects you from getting phished if the phishing site is just logging credentials for use later use. If they are going to use your credential right away it is no protection.

If a site allows both TOTP and a hardware-based system though you can use the hardware-based system normally, and only resort to TOTP if the hardware is lost or broken, and stop using TOTP as soon as you can get replacement hardware enrolled.

For TOTP when you are setting up and the site gives you the QR code, scan that in TOTP apps on your phone and if you have one on your tablet. Also save a copy of the QR code somewhere safe. I save an encrypted copy on my desktop computer. If you ever change phones or tablets, you can scan the QR code again.

Some sites will also give you the TOTP key in text form. Save that somewhere safe and you can use it with command line TOTP tools such as oathtool [1].

[1] https://www.nongnu.org/oath-toolkit/oathtool.1.html