What's the industry standard for verifying phone number ownership?
I don't think there is any written 'industry standard', just as in any case when generating random numbers: Just use properly-seeded CSPRNG. Closest thing we have is TOTP/HOTP.

Both of your ideas are far more complex to get right from what TOTP/HOTP roughly does: Take CSPRNG, output 4bytes, truncate to 31bits, and take modulo 1000000 (Please note that TOTP/HOTP actually have bit more to it, refer to according rfc for details). This yields very small bias, which isn't a issue.

As SEJPM noted in his comment, SMS can be captured, and especially recently, some parties who used 'best recommendations' were hacked with SMS-reset of password. Therefore you should consider TOTP/HOTP, and SMS can be implemented as a variant of HOTP (which would allow you to check if one of previous tokens was reused).

So in short: neither 1 nor 2. Use properly seeded CSPRNG (/dev/urandom or CryptGenRandom can be used), then take 31-bits and modulo them to 1000000. Better yet, allow usage of HOTP/TOTP (which does basically same thing, without relying on channel security).