Not necessarily a better method, you might even say it's a lazier one 🙂 I just tend to give the Application User the System Admin role. Since it's configured on the Pipelines and no one can actually retrieve the client secret or change the pipelines definition. It's "secured" that way.
The ALM process I was talking about in the past was for a higher profile security project where they wanted to cover all their bases so we went with minimum required, there was just solution imports of a relatively straightforward implementation, no data.
As soon as you add Data Migration (for reference data or configuration) you'll need a security role that grants access to tables other than metadata ones if you want the dev or a pipeline to do it.
Also, I'll be honest, because I tend to use Sys Admin role I'm not sure if Environment Variables, Flows, etc work with just System Customizer, something to test if they're part of your solution.
