Microsoft Graph vs SharePoint Client Object Model or REST API
Microsoft Graph doesn't have full parity with the SharePoint Client Object Model or REST API. If you're just updating items in SharePoint lists or libraries then you'd probably be OK using Microsoft Graph, but there's still a chance you'll need to do something not supported by Microsoft Graph. My suggestion would be to stick with the SharePoint Client Object Model or REST API for now.
Application Permissions vs Delegated Permissions
Application (app-only) permissions are used in two scenarios. First, when there is no current user. For example, when you have an Azure Function running on a timer. Second, when you want to elevate permissions. For example, you want your application to be able to create a new list but you know that some of the users of your application may not have permissions to do so.
When using application permissions, the permissions of the app are the only thing taken into account when a request is made to SharePoint. If the app has been granted the necessary permissions, the request will succeed.
When using delegated permissions, both the user and the app must have been granted the necessary permissions for a request to succeed. For example, if you want to create a list the both the app and the users must have been granted the necessary permissions to create a list or the request will fail.