Using OAUTH PROXY

Steve Switzer  Is your developer referencing utilizing an Azure Enterprise Application Registration?  

This is a easy and secure way to allow the developer to use the native API call in the Office 365 Stack. 

You can find more information: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-integrate-apps-with-azure-ad

The other option is to use an Azure Application Proxy.  This is used to broker secure connections for on premise applications against Azure AD.

You can find more information: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy

Both of these can utilize OAuth.   If you can use an Azure Enterprise Application Registration it has a much smaller footprint and requires a lot less work.