You have been nothing but incredibly helpful, thank you so much! The API solution is what I had in mind, but knowing it can sync itself works perfectly as well.
We could, yes. I was going to attempt to use plus-addressing first, that way at least some users would still get emails from the start. Then translate over to our own SMTP mapping server later to support everyone, including those who plus-addressing didn’t work for.