without using any sort of plugins
You custom-code everything yourself 🙂
Being realistic, using a forms plugin is going to be the easiest way to do this by a very long way! You may need to possibly set up two forms, and do some additional custom work yourself, but it is possible.
If you want to do it yourself, you’ll need to figure out how you will send out and authenticate the codes, and what processes you’ll need to move the process along. That’s the starting point and where I’d suggest looking at before even thinking about any coding.
If you have some questions about how your code can work in with WordPress let us know, but that’s about the best that we can do here.
Even if you want to custom code everything, you can still look at established plugins to see how they manage things and use what they do as guidance for your own efforts.
You might consider using the WP nonce scheme to generate a confirmation code. You control what “seed” is used so you can confirm each nonce only matches to a particular user. WP nonces do expire, their time frame can be altered by filter. They are not true nonces, they can be used multiple times, so you’d need an additional scheme to ensure one time use.
If your intention is only to ensure a valid email address, you could simply email the direct download link which includes a nonce that the server would validate before streaming the donwload data. Minimizes back and forth and enhances user experience.
