If you need a network boundary, what MCP provides that REST API + llms.txt can't do?
You can have your IT department configure an MCP for the org, and your regular non-technical users click a button and login with their account the service. Then they get all the tool calls authenticated as themselves.