Veeam M365 - Modern App Only Authentication best practices ?

Hello guys,

Following the Disable Basic Auth in M365 since Oct. 1, 2022, I m looking for the best practices to implement the Modern App Only Authentication.

I ll not explain why it’s important to protect M365 datas @Iams3le already did it very weel right here: 

To improve security, I would use the least privilege approach and only assign the permissions which are required for the task at hand. But I m a bit confuse with the best way to do it.

Regards the required permissions in the help center (https://helpcenter.veeam.com/docs/vbo365/guide/vbo_required_permissions.html?ver=60), we need Veeam Backup Account Permissions and Azure AD application permissions.

Is the Veeam Backup Account Permissions mandatory with the Modern App Only Authentication? 
In my understanding is only needed when we need to use the legacy mode.

For the creation of the Azure AD app, we need to provide a user to login to M365. What kind of account do you use as this step? A dedicated service account or an admin user account?

The requirements for the user account are the followoing:

• Global Administrator

It’s a privilege role so I would like to limit this attribution.

if I create a custom Azure AD application do my account still need to have this permission?

Thanks !