Yes, that’s possible.
You can use Salesforce as an identity provider for single sign-on access to Marketing Cloud and access Marketing Cloud from a Marketing Cloud tab in Sales or Service Cloud.
To enable the single sign-on authentication and key management features for your account before performing this configuration, contact your Marketing Cloud account ...
You are basically correct. If a user is using SSO, the third-party server is authenticating the user. No password is necessary if they will not be logging in directly to Salesforce. This is true for Delegated Authentication as well as SSO via SAML or another authentication method.
Yes. You can configure multiple Identity Providers in the same Org and let Users choose which IdP to use when they login. There is no restriction to be able to configure multiple IdPs in an Org.
I have had a similar use case where Users were located in different continents and the IdP was specific to a particular continent. So we went ahead and configured ...
In general, for oauth to work, the user needs to authorise salesforce to perform requests on their behalf.
If you haven't done it already, I suggest you go through the documentation on the many different types of oauth flows, and see if one of them fits your scenario.