Can I set up a REST API source that uses OAuth to authenticate for both syncs and external transforms?

I’m setting up a pipeline that reads from and writes to an external system. That system uses OAuth for authentication and has given me a client id and secret.
Where we’ve done this before in the past, we’ve used the sunset legacy REST API source type and configured a separate auth call to extract the resulting token prior to the main call.
We also used the now-deprecated export tasks to write out to the external system.

This time around, I’d like to make sure that I’m only using supported platform features if possible (the new REST API v2 source type + external transforms). I have read some info in the docs about using outbound applications for OAuth but it sounds like there has to be a popup shown to a user, who then approves the connection? That won’t work for us since the pipeline is fully automated rather than involving webhooks and specific user actions

Is there a way that I can make this work or do I need to copy the legacy setup again?

This is a little bit confusing. You only need outbound applications for the authorization code grant oAuth flow.
Since you are using the client credentials flow you can use the new Rest API with two chained API calls. In the first you get the token and than you use the token in the header of the second call. This can be configured through the UI.