How do you deal with things like "we sent you a one-time code to confirm your login"? Most of those are HTML-formatted today

I still can check the SPAM folder, if needed.

But most SPAMs are HTML, so you'll have a good default last-stage in-client filtering in place in case some SPAM actually makes it through the other setup on the server (greylisting, DNS based filtering lists, policy-based filtering, etc.) :)