Interactive (i.e. end-users) Clients should be using OAuth instead of app passwords. This will allow your users to use their own Office365 credentials for SMTP.
For servers and non-interactive clients (e.g. copiers/printers/toasters/coffee makers) I would suggest something along the lines here: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#compare-the-options