See http://blogs.msdn.com/b/kaevans/archive/2015/03/23/using-openid-connect-with-sharepoint-apps.aspx where I explain that the app is anonymous by default but a user cannot access content because of the way that TokenHelper checks first for a valid context token. If a context token is passed, you use the context token to obtain an access token. If that call fails, then you do not show information to the user. That is the same result as what you asked for above, you can be assured that the user logged into SharePoint else you will not receive a valid access token.
If you use Visual Studio to create a new SharePoint provider hosted app and are using the app+user policy, then you can make a CSOM call to get their effective permissions to determine how to proceed. Alternatively, the blog post that I linked shows how you can call the Azure AD Graph API, which could be used to get the user's groups. Since you are using O365, you will have Azure AD at your disposal. You can use this to make further decisions on role-based access.
Slight corrections to Falak's points, provider hosted apps can be run on any platform. We have demonstrated low trust apps using Linux and using a variety of technologies such as PHP, Node.js, and Java. There is no requirement for Azure, the term "provider hosted" simply means that there is no hosting environment provided for you, you need to find a hosting environment such as AWS, Azure, Rackspace, your own data center, etc.