Yes, you're allowed to upsert against a Salesforce ID. You can read more about this in the various documentations, such as REST and SOAP. In fact, in some objects, you can even use the Name field, as long as the idLookup property is true for that field. In fact, the documentation even calls this out explicitly:

This example uses the POST method as a special case to insert a record where the Id field is treated as the external ID. Because the value of Id is null, it’s omitted from the request. This pattern is useful when you’re writing code to upsert multiple records by different external IDs and you don’t want to request a separate resource. POST using Id is available in API version 37.0 and later.

Note that each documentation calls out a minimum API version. This shouldn't matter since you're doing a new integration, just calling it out so it's not accidentally overlooked.

Yes, you're allowed to upsert against a Salesforce ID. You can read more about this in the various documentations, such as REST and SOAP. In fact, in some objects, you can even use the Name field, as long as the idLookup property is true for that field. In fact, the documentation even calls this out explicitly:

This example uses the POST method as a special case to insert a record where the Id field is treated as the external ID. Because the value of Id is null, it’s omitted from the request. This pattern is useful when you’re writing code to upsert multiple records by different external IDs and you don’t want to request a separate resource. POST using Id is available in API version 37.0 and later.

Note that each documentation calls out a minimum API version. This shouldn't matter since you're doing a new integration, just calling it out so it's not accidentally overlooked.

Here's an Upsert example from the Workbench:

This uses the PATCH /composite/sobjects/<sObjectName>/<externalId> method of Upsert. This method supports 200 records per call.