...
Using the Safe Token Service (STS) is highly recommended if you have a large number of hardware tokens to manage, as STS has a powerful management portal that allows administrators or the help desk team to manage tokens (such as assign, unassignun-assign, and reassign re-assign tokens) in a few clicks. STS also has a self-service portal that allows users to self-enroll their tokens.
Using the Graph API is only suitable if all of your tokens will be self-enrolled by your users, as the Graph API does not allow administrators to assign or unassign there is no UI for administrators or the help desk team to manage tokens.