Yes, you do need to provide the original sources, so I would reach out to Instagram. This is also something that you should do in the planning stages -- e.g. before you decide whether to go ahead and make this integration. It will also pull Instragram into the scope of testing.
Unfortunately it occasionally happens that Company A decides to do an integration between Salesforce and Company B, without telling Company B or checking to see whether Company B is willing to provide all the support necessary to go through the review (they may be tested themselves).
This is a good recipe for getting squeezed, as Instagram may not want to be integrated with Salesforce, and even if they do, it may not line up with their timelines. There are currently integrations between Salesforce and many third parties, such as Linked In, Citrix, Google, etc. But they all require full disclosure of source code being loaded on Salesforce servers as well as some kind of mutual test arrangement. Bottom line, it's not something that you can volunteer for the third party without their consent.
Make sure that you have everyone on board before going ahead with the integration. When companies like Instagram publish general connectors, it's often a take it or leave it proposition for publishers to decide to put on their own site. Instagram may not be willing to support the connector by providing source code or offering you the ability to test their API. That may be fine for your own website (or even your own Salesforce org), but if you are planning on publishing a generally available managed package then you do need the full cooperation of the third party behind the connector in the security review.
