Yes, this is correct. AAD would be the topmost layer and SharePoint would provide the granular layers where we can apply control.