How to access O365 Outlook account via API?

Question

API

Is it possible to use an Outlook(O365) account to access calendar events from the app?
For myself, I saw two options:

1. Get USER-tokens (refresh / access) and shove them into the application.
There is a problem that the password can be expired, hence the need to manually update the tokens again.

2. Get access to tenant and load user data (/user[]/event) using app-token.
But then it turns out that I have the opportunity to search / get the data of all users within the organization?
Is there a way to put restrictions on this method? Or is it all or nothing?