It seems that I cannot do this here because OAuthComponent will completely take over the process since its startup() method performs very similar work to OAuthAuthenticate::getUser() with the addition of [allow|deny]ing access.

I will try to refactor the OAuth2 wrapper into a Lib class so that it can be used independently.