No, Control Panel Vendor partners can't utilize the app only authentication style to request access tokens on the behalf of partner. They should implement the secure application model, which utilizes the app + user authentication style.