There are many subscribers who use managed 1GP or 2GP as a way to manage their organization's metadata or provide a feature to one of their clients. The actual documentation states:
Every version of your managed package that you plan to list publicly on AppExchange must go through a security review. The review for a new version of a package that passed a security review is automated, and typically only takes a few minutes.
Note that this is a specific statement of intent. If you do not want to be listed on the AppExchange, you do not need a Security Review. There are two specific expectations for such packages.
First, you can't charge for a package that's not covered by a partner agreement with salesforce.com. This is laid out in the various service agreements that you automatically agree to by use of the Salesforce platform. If you're found out, you can find yourself in court, your package disabled, etc.
Second, you can't do anything that would cause risk or harm to the subscriber or the platform. Causing undue performance loads on Salesforce, stealing or leaking subscriber data, etc. Basically, doing anything that you shouldn't be doing on the platform against the service agreements. Again, the punishments can include legal problems and disablement of your package.
Given your specific statement:
...the main application is hosted off platform and this will be a small convenience app for customers to install...
That's one fair use of a managed package that doesn't need to be listed on the AppExchange, as long as you don't charge for it, or charge extra for the convenience it provides. It must remain completely unencumbered to stay within the rules. As long as you're following the rules, you should be just fine.
Note that 1GP that are limited to a major.minor version system; you can always upgrade to any later version from an earlier version, assuming you do not make it a Beta version. Beta versions can't be upgraded in any org, and cannot be installed in production orgs. For 2GP, you get a full four version numbers to work with (major.minor.patch.build) style version number. This is also true for unlocked packages. That's because 2GP doesn't need a "patch org" or even a "packaging org" to work with.
Note that 2GP has specific restrictions on deleting metadata from the package once uploaded as Released, so the Unlocked Package route might be better, but doesn't offer IP protection. If you want to protect your APIs or secrets, 2GP is the way to go.