what is best practice. actually our customer login using mobile no. and otp but our partner or office employ login using email or password. user database use same both of or different if same then can give email or password empty.