Java and Javascript - How to authenticate against the box API without manual user intervention?

Hi, I am building a web-component to be placed in an existing web-page that takes a folderId and makes a call to Box to retrieve contents and display the contents in a table for users to then download files or navigate to any subfolders within the given folderId.  We have some sorting requirements and also custom metadata we need to surface for each file/folder which the out-of-box Box UI does not provide.

My question is this:  How does one accomplish this without the need to have users having to login to box first?  

This same component will be used by external clients to view files as well.  They will be gated to only the given folder and I am checking for specific custom metadata to show only those files that are for clients and filter out the ones that are for internal users.

P.S. I am also curious about how folks have built similar apps in the past?  Is it best to create separate users and 'view as' to handle access control or is the cost alternative route okay given the basic needs we have.

Thanks to all who read!