SPN with AAD token is the general and secure approach. But it turns out that they don't know anything about Azure yet, none of the team members were onboarded to Azure platform.