Outlook web add-in autentication failure for on-premise exchange

Question

I use Office.js's getCallbackTokenAsync to load the token to pass to the backend.

In the backend, I use EWS to retrieve the email data. Here is how I perform the authentication.

ExchangeService service = new ExchangeService();
service.Url = new Uri(ewsUrl); //retrieved from getCallbackTokenAsync
service.Credentials = new OAuthCredentials(ewsToken);// retrieved from getCallbackTokenAsync

It works well in exchange online enviroment. However when tested in on-premise exchange server, I got this authentication error:

Error Message: The remote server returned an error: (401) Unauthorized.
Stack Trace:   at System.Net.HttpWebRequest.GetResponse() at Microsoft.Exchange.WebServices.Data.EwsHttpWebRequest.Microsoft.Exchange.WebServices.Data.IEwsHttpWebRequest.GetResponse() at Microsoft.Exchange.WebServices.Data.ServiceRequestBase.GetEwsHttpWebResponse(IEwsHttpWebRequest request)

I then found this doc says the Oauth2 authentication is only for exchange online. I guess I need to use this NTLM (Exchange on-premises only).

The major reason I use EWS instead of Graph or Rest is it supports on-premise server more naturally. So should I change the authentication here? I certainly do not want to ask user for username and password.