I would say it all depends on the requirements of your project. If your users will be interacting with Strapi’s api, I don’t see the need to overcomplicate things and just use Strapi authentication flow.
But what you mentioned about using your own provider and using API token to communicate with Strapi is also a common option.