I know that the concept of TOTP is for when the device on which the code is to be verified is separate from the device that is going to generate the code.
However, I was wondering if it is a bad idea to use the TOTP algorithm for generating the verification codes used in email/phone_number verification (where the code is both generated and verified on the same device which is the server).
You probably could, but it doesn't make much sense. Email and even SMS can take long enough to reach people - even people who are explicitly checking for the message - that you'd need to check the last few minutes of codes, which broadens the range of allowable values and slightly increases the risk of an attacker guessing/brute-forcing the code. Meanwhile, the whole point of TOTP - that the generator and the verifier don't need to have any communication channel and only need two common pieces of info (the key and the clock) - is moot here.
Instead, just generate a short code using a cryptographically secure (pseudo)random number generator and send it to the recipient, plus store it (possibly in hashed form) briefly. You can use a database, or just store it in RAM or a cache if that won't pose problems due to load balancing, etc. That way there's only one valid value, you can revoke it immediately any time you want to (e.g. once it's used, once it's expired, or if you detect multiple failed attempts), and there's no persistent secret (the TOTP key) that can be stolen by an attacker to enable generating all future codes too. You can also easily make changes to your codes - change their character set, their length, the way they're generated, etc - any time it feels important.
As a side note, if your site/service has any highly sensitive data - payment info, sensitive PII, etc. - please do not use anything SMS-based as a sole authentication factor. SMS is not very secure, and also mobile phone operators are notoriously bad at verifying your identity before re-issuing your SIM card (or otherwise transferring your number) so possession of a given phone number is not strong proof of identity. Even US government guidelines (which are in many cases behind the times) say you need to offer alternatives to SMS and explain to users that choosing SMS for authentication (assuming you offer it at all) is taking a risk. SMS is acceptable - though still not ideal - as a second factor for authentication, most commonly in combination with a memorized identifier (password/PIN).
