Yes, you are correct. I didn't mean to imply that the type of two-factor authentication that you choose didn't matter. You obviously have to select the type that's the best fit for your company. My point was that the most important decision is the decision to make the leap to two-factor, and then the second decision is to pick the type that works with whatever compliance regulations you're dealing with, with your end users, your budget, etc. etc.