Extend the spo tenant settings set command with the DisableCustomAppAuthentication true|false option to allow admins to configure if ACS-based app-only auth should be enabled or not.

For the implementation see the Set-SPOTenant cmdlet