I use classic tokens on low-privileged accounts for scraping public repos. I suppose organization level permissions would work fine for me.