KeyCloak, PrivacyIdea and Email Gateway
There is no need to push any OTP values into the keycloak database.
You can use the new privacyidea keycloak provider.

The user logs in with his username/password and the privacyidea-provider will take care, that the users get the email and ask in a 2nd dialog for the OTP.

See:
https://github.com/privacyidea/keycloak-provider