Box App API Best Practices question

Hi all,

I find it will probably be best to share what I'm looking to do, and then how I implemented for now, but am curious if it is the right solution in regards to privacy.

Our customers would like to give our application access to a particular folder which will contain all their files that they would like to share to our app. This account is their enterprise account that is shared among many users of our application under their company umbrella.  When they go to "upload via Box", they then have a file picker and are able to view and select a file they want to share with an entity in our application.  Then when viewing that entity they can view the file they shared.

The way I have it currently implemented is such:

1. They authorize our app via their box account with our API Key

2. They will share with us their enterprise ID

Where I am unsure is if they should create a user under their account and share it with us somehow and make that person a collaborator on the folder they want us to have access to... or we can request access to manager users and create a user under their account.  Then they authorize this user access to that account.

Both of these sound weird to me and asking them to create a user or authorize our user sounds strange.  I'm personally not used to writing integrations so any help would be amazing!

Thanks!