Yes, this is the right approach. Create a private app with the correct access scopes, and your affiliates can create orders on Shopify via the API. The only risk here is if your affiliates do not make correct use of the Shopify API. Depending on the number of affiliates you can set up multiple private apps so you can delete access for one without affecting the others if you so wish.
I see that Dear systems has a Shopify App, you could explore that for the integration ($$$!) DEAR Inventory – Ecommerce Plugins for Online Stores – Shopify App Store or do a custom integration with the Dear Systems API. In either case, you would need to map your product IDs between Shopify and Dear so they are consistent.
If you'd like any help setting this up, let me know at firstname.lastname@example.org