We are currently thinking about idea of Outlook add-in to call our web service (neither EWS nor Outlook REST API). The main question is - is it possible to pass user credentials to IIS server that hosts web service protected with Windows authentication? We are using Outlook with Exchange, yes.
You may consider your VSTO based add-in as a regular .net application. Every option that are available in the .net world is possible with the add-in. Take a look at the following pages for choosing the best solution: