Since your web mail client is just a front end to some existing email account you can simply use the IMAP/POP login information as the login information for your web mail client. In this case you don't need to store any credentials permanently for retrieving the mail.
Since you probably need access to the credentials while the user is still logged into your web mail application and you don't want to ask the user again, you might include the credentials in encrypted form inside the session cookie, for example as encrypted payload inside a JWT based cookie.
While many (most?) mail providers have the same credentials for IMAP/POP and for SMTP they might be different for some providers. In this case you could encrypt the SMTP credentials with a key derived from the IMAP/POP credentials so that they are only accessible for somebody having the IMAP/POP credentials already. You might then store this encrypted credentials in a database or you might store it only at the client side, for example in the browsers local storage or in some cookie with a really long expiration time. Storing these encrypted information at the client side has the advantage that no sensitive client information need to be stored at the server side at all.