TOTP works fine with physical tokens. e.g. http://onlinenoram.gemalto.com/

All they need to do is let users locally generate (i.e. in the token) seeds and then enter those into the web portal, vs. generating seeds internal to the portal, displaying them, and having the user enter them into the authenticator app or token (because the tokens don't allow you to enter a seed).