It really depends on what you're protecting against.
For websites, the gold standard is WebAuthn or FIDO2 because those provide protection from phishing. In those situations, the web browser reports the actual site, not just the site you think you're on, to the security key and as such, it makes phishing nearly impossible. Because the operation involves a secure digital signature, it is computationally infeasible to forge.
However, TOTP is a major improvement over SMS based authentication because it is generally much more difficult to intercept and changes constantly unlike a password, even though it is vulnerable to phishing if the attacker logs in to your account right away. I personally use it as a backup solution to my YubiKey in case the YubiKey gets lost.
As vidario notes, there are a variety of proprietary solutions from companies like Duo and Microsoft that send login requests to a phone. However, these are also subject to phishing in the same ways as TOTP, and nobody wants to install a bunch of different apps on their phone for every random website, so these are usefully limited to corporate environments only.
So if your concern is protecting against weak passwords or random guessing, then any form of 2FA is likely to be good enough. If you want to protect against attackers who are actively trying to compromise high value targets, SMS should be avoided and at least TOTP, if not also WebAuthn, should be deployed.
My personal recommendation for websites deploying 2FA is to deploy WebAuthn and TOTP. These are the best possible options and are open standards, they support the widest variety of devices, and they also avoid the inconvenience of sending SMS across different countries (which I can tell you from personal experience breaks often when you have a foreign phone number). For sites that do offer SMS 2FA, I recommend providing the ability to turn it off, so folks who are at high risk or who are concerned about security don't have to worry about it as a threat model.