Private Content

I need best practices on how to handle this request from one of my developers:

They wish to use the V2 API call to access private community messages

How do I do this?

I believe I have to give the username (using the V2 API) permission to access this data so does this mean I have to create a new role in this private category? So they can see this content and be able to pull the data?

In fact, I would not mind meeting with someone to give me a review on how they handle API requests in their organization.