I am using Twilio's phone number verification currently, and I want to make sure that the user has their email address also verified (or at least associated to their user in the user db). Is it possible to make them both a requirement using something like RLS?

The phone and email are part of the jwt so you could certainly use RLS with the auth.jwt() function to check them.