Unless I misunderstood, Sign in with Apple is a required option, not the only required way to login. Of course it remains to be seen how long other options are allowed to coexist.
And I believe it's only required if you offer. "sign in with facebook" or "sign in with google" link. If everything's self-contained (ie Netflix), no issues.
Required if you have other THIRD PARTY logins.
If you are your own (and only) account provider you should be fine.
is active directory (a product not a service) a third party?
That can't possibly work. How do you handle tokens, 2FA, etc?