Authentication issues

Peter,

One approach would be to request Delegated permissions for Graph SharePoint API calls and App Only permissions for Graph Security API calls. Your application would essentially be acting as a service when it retrieves security alerts, and using the user account your created when writing those alerts to the SharePoint list.

Without knowing how your application is invoked I don't know if this option is feasible for you. It doesn't sound like the app is an interactive app since you've created a user which sounds like it's acting like a service account and reading and writing alerts. App Only seems like a viable option. Just make sure if the application is interactive, that it doesn't let regular users view security alerts when they otherwise wouldn't be able to.