Just for an update on my own problem, we couldn't find a way to make this work as we wanted. Appreciate the solutions offered, but some of them seemed to impact the entire user set or how logins worked across the board.
Just wanted to provide the login.do method or username/password method for some specific users to use. In the end kind of sorted this at the account level by just creating company accounts for these third parties and that sorted it.
But seeing a potential solution someone provided with permitting login.do at a specific app level, that might be interesting to explore as the app in question is just the Agent app which in contains a custom applet. Might be a good avenue to check
