Supported App-Only APIs for SharePoint Site Access and Group Membership (No PowerShell)?

You do not need to invoke PowerShell: a backend can call SharePoint REST or the Microsoft SharePoint CSOM directly. Use an Entra application with certificate-based app-only authentication for SharePoint CSOM/REST, and obtain an administrator-approved permission scope appropriate to the operations. Enumerate the site's associated Owners, Members and Visitors groups and their Users collections. However, those collections are not a complete effective-access report: entries can include directory groups, and access can also come from other grants. Resolve directory-group membership separately where needed. For a named user, CSOM's Web.GetUserEffectivePermissions provides a permissions result; evaluate the required permission rather than treating group membership as proof of access. A successful permissions check also does not guarantee that Conditional Access will permit an interactive session. Keep Graph for supported directory operations, and avoid relying on an undocumented beta endpoint as your production authorization boundary.