Hi,
For your first question, yes, but Office 365 only allows low trust Provider Hosted App.
Office 365 low trust Provider Hosted App use Azure Access Control Service to access data from external domain.
Here is a detailed article for your reference:
Handle security tokens in provider-hosted low-trust apps for SharePoint 2013
Thanks
Best Regards
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
tnmff@microsoft.com.
