so the risks are essentially the same as a web wallet like btc.com or blockchain.com? when you add 2fa and compare to a centralized exchange account, that's not bad.
Blockchain.com would be the best match since I am familiar with it too (I don't know why I had to even compare it to metamask 
). The only difference is Portis can easily interact with Dapps through the Web browser, something Blockchain.com can't do.i just tested this---you don't need to actually use a real email address. it just functions as a login.
You actually need the email address to be real because when you first attempt to sign up, there is a message that's sent to the email address for verification. You can still sign in minus verification but sometimes if you sign in from a different browser or device, the sign in could be flagged as suspicious and a verification message would be sent to your email address as I have experienced it before. Without a real email address, you won't be able to access your account (if you didn't back up your recovery phrase)You also need your email address and Backup recovery phrase to reset your password in case you have forgotten it.