My opinion on random vs. time-based OTP (TOTP)
With a random token, you need to keep track of what was generated for whom, when it expires, and you need to purge the expired tokens.
A (TOTP) has the inherent feature of be being useful for a defined period of time. If the server receives an OTP for an account, the server can generate OTPs for that account starting N minutes in the past and work up to the present (or go the other way). If any of those server-generated OTPs match the given OTP, then you know 1) it's valid and 2) it was created within a given time frame in the past. There is nothing else that the server needs to keep track of to validate a TOTP.