When you add the scope to your custom app, you need to also grant admin consent to it, otherwise any attempt to obtain a token will trigger the admin consent prompt. After consent is granted, use your custom app to obtain an access token (for the specified resource, b26e684c-5068-4120-a679-64a5d2c909d9). Then add it to your curl/Invoke-WebRequest request, along with the X-AllowWithAADToken header.
I posted some more detailed instructions here, if the above is not clear: https://www.michev.info/blog/post/5806/using-the-graph-api-to-export-ediscovery-premium-datasets