We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case.
The page does not need access to any data within salesforce and there isn't any SSO between salesforce and the external application.
In the iframe approach the url would be something like the following:
iframe_token is a one-time use token generated by the API (an apex callout would retrieve the token).