OneDrive for Business does not have an encrypted vault (though the files are stored encrypted at rest/in transit).

As far as 'no more access than', OAuth apps can have full control over your tenant and all data.