Can you check email filtering is enabled in your mail server. When we have the email filtering enabled in their email server, What happens is that the filter performs an inspection to the email to validate if there is any malicious code or behavior, which means that the filtering will click on the link that is a One Time Access link to access. So, we are suspecting that when the email clicks the link, User portal is getting logged in without entering the OTP.