Instead of adding an account to the device with all of the management software that goes with it, one could use a generic SMTP email client (K-9 Mail?) and still get the email, but not have to worry about the privacy and remote administration concerns.

Edit: nevermind, I skimmed the question at first, and didn’t see the duo limitation. This solution probably isn’t an option.