Sadly the number of email clients I would trust is limited, many send off your credentials to some remote server.
EDIT: k9 already supports oauth for imap.
To perform the oauth2 login, the app is forced to send the user to a specific Google webpage. There are only 2 ways to do that, load it inside a WebView within the app or send to an external url to be opened by the phone browser.
In both cases, Android (/Google) will capture that and use the "add account to Android" provider.
Now, let's suppose that you want to use your own custom WebView to avoid that, then the oauth2 page on Google server will perform a check against that and will refuse to load. Officially "for security reason for the user".
:-(
IMAP/POP passwords have long defaulted to disabled in Gmail, Gmail survived 20 years without need for these new restrictions, I can't imagine attack techniques have improved and Google's internal technical staff have regressed so substantially that they are now essential. This change seems more motivated by creating frictions for escaping the Google vortex than anything to do with security.
I can definitely imagine, and I in fact believe, both of those things to be true.