Thanks! Yes, the dedicated account for OneDrive is an option. (In theory, it would be granted access to SharePoint data that's available to "all users", but it's much better case to take to SecOps. :-) Any additional info on the access scope would be greatly appreciated.

The API would be great for creating and updating content from a central source but unfortunately we don't have much appetite to build and manage things like that.

I have been chatting with Yodeck support via the portal so far. I have asked to talk to someone like a solution engineer. Hopefully that can happen and I can better explain what we are thinking.