Reference:
https://docs.microsoft.com/en-us/dotnet/api/system.net.http.headers.httpresponseheaders.wwwauthenticate?view=net-5.0

Explanation
To use Microsoft Graph to read and write resources on behalf of a user, your app must get an access token from the Microsoft identity platform and attach the token to requests that it sends to Microsoft Graph.
One common flow used by native and mobile apps and also by some Web apps is the OAuth 2.0 authorization code grant flow.
Scenario: Email the generated invoices to customers on behalf of the current signed-in user. Any emails generated by the system will contain the invoiced.
Use Azure AD to manage identities, authentication, and authorization.
Reference: https://docs.microsoft.com/en-us/graph/auth-v2-user

Explanation

Box 1: Yes
Using the isolated web parts capability, you can build web parts that securely communicate with APIs secured with Azure AD without exposing the access token to other components on the page or even scripts in the tenant.
When deploying these solutions to the app catalog, all API permission requests are specified as isolated.
Box 2: Yes
Even though on runtime isolated web parts will be loaded inside an iframe pointing to a unique domain, you can communicate with SharePoint REST API, the same way as you would in non-isolated web parts.
Box 3: Yes
If you're upgrading an existing SharePoint Framework project to v1.8.0 and want to use the isolated permissions capability, you can do it, by setting in the config/package-solution.json file, the isDomainIsolated property to true. You should ensure, that your project contains only web parts.
After changing the project to use isolated permissions, you should redeploy your project. This will issue new API permission requests, isolated to your solution, which will need to be approved by the tenant admin.
Reference: https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/isolated-web-parts