MS Purview InformationProtectionPolicy - Extract Sensitivity Labels - Permissions Granted

There is no good solution for this via the Graph API. You can only use it to get published labels, and if you use delegate permissions (the first method you describe above), you will only ever see labels published to said user. With application permissions, you should be able to get all published labels, but again, this does not represent the full set of labels in the tenant.

if you need a full list, your only option is to use SCC PowerShell and the Get-Label cmdlet.