Is there a way to avoid the box grant page for custom box apps for oauth 2 authentication?

  The grant access page is required for standard oauth2 applications. You would need to leverage oauth2 with JWT to bypass this. 

Best, 

Kourtney

Box Technical Support Engineer

But what kind of BoxAPIConnection do I need to get the user-specific token? I would like to reflect the folders on their box service account into the app.

 If you want to get a token for a specific user, this is done in the JWT assertion.

You will want to set the the box_sub_type to user and the sub to the user ID of the user you want the token for. Also, you'll need to ensure you have "generate user access tokens" enabled in the configuration tab of the dev console. If you don't already have it enabled, enable it and ensure you reauthorize your application in the admin console.