C
First, a note of caution: Unless you securely receive and verify the user's public key ("Security Number" or whatever WhatsApp calls it), WhatsApp is no more secure against spoofing than normal SMS is (because normal SMS is the only way it authenticates users). If you're trying to avoid using SMS because it's expensive, then WhatsApp is a reasonable alternative; just don't think that it's dramatically more secure than SMS. It is arguably more secure in that it's encrypted end-to-end, so it can't be intercepted en route, which is a significant risk with SMS. However, it's also more likely than SMS to be routed to multiple devices (one if which might have been stolen or shoulder-surfed), and/or for a user to still have a WhatsApp number that is no longer their phone number (in which case the WhatsApp account could be stolen from under them at any time).
If you want to add some extra degree of security, your WhatsApp client could record the user's public key when they set up the WhatsApp auth factor. That way, if something happens to their WhatsApp account, you'll know because the public key will change.
To actually answer your question: it's arguably better to use the QR code, since that can be sent through an already-authenticated channel (the HTTPS connection to your front-end, presumably a webpage), and then let the user respond from an account that they trust. Simply sending the code to a number has a small risk that it's not a number the user controls any more (maybe they recently changed numbers and gave you the new one, but hadn't updated their WhatsApp account yet, and somebody else had gotten the old number and set up WhatsApp to route that number to them). There's also a small risk that the user just made a typo entering their phone (WhatsApp) number. In either case, you risk sending the second-factor code to the wrong person, who - if they can guess the legit user's password - could then log in as the user.
Otherwise, though, it doesn't matter. Most likely you'll answer this question for other reasons (cost and user experience) rather than security. That's especially true if you expect your users to rely on WhatsApp enough that there's almost no risk they'd make the mistake described above (though note: people get their email address wrong all the time; getting a phone number wrong is pretty easy).
While you're at it, consider adding support for https://webauthn.guide/ (see libraries https://webauthn.io/ ), which can use either hardware tokens (e.g. Yubikey, Titan Key) or platform security (OS login methods such as FaceID, TouchID, Windows Hello, Android's fingerprint scanner, PIN, etc.) to securely perform public-key-based authentication. WebAuthn can be used as either a second factor or as the only factor, and is the only authentication system I'm aware of to provide really strong anti-phishing protection (the public key is unique per site; even if the user doesn't realize they're on the wrong site, their browser will send a different public key). It's also often more convenient than OTPs or TOTP (e.g. Google Authenticator).