1 - Credentials
In general, you're going to be limited to what the service is willing to support. It sounds like the alternate password options are not insane - if you can use OTPS, or alternate passwords with some limitations, you have options for scripting a transfer process that are at least a little better than leaving your password somewhere.
Generally it'd be nice to separate the read-only ability for logging in and downloading a copy of sent/received emails from the ability to perform email sending capabilities. If none of the alternate credential options offer that, than I'm not sure they really buy you much of anything.
Your big questions are:
- how secure can you make your credential storage on the VPS?
- how painful is it to update passwords and what are the verification processes involved?
- what's the risk for someone getting their hands on this credential?
2 - Data Security
The fully correct approach here is to secure both the data in transit and the data at rest.
- you'll end up limited to whatever connection methods the email service provides.
- remember that it's great to lock up your email archive route, but if you are accessing the mail in the clear when you use it on a daily basis you haven't really done much. Securing access means securing all parts of access.
- there's a number of encryption solutions - it largely depends on what your storage method allows.
- remember that you're only as good as your encryption secret storage - if you encrypt everything and then have to store the encryption key in the clear on the server, then you didn't really do much.
3 - Alternate Options?
I'd wonder if you don't have other options - for example, can you forward copies of the email you want to archive to the VPS as an alternate email address. In essence, pushing rather than pulling the data. Then you may not need any credentials on the server. Ideally that'd be automated and constant.
Or could you consolidate and encrypt mail on the mail system and then pick it up from VPS - that would definitely keep any keys off the VPS and give you both in transit and at rest security.
I'm being vague here - all of this relies on the details of the mail service and VPS, I'm just focusing on some common design ideas that might be useful. My general thought is that security is only ever as strong as the weakest link, and often you can change the equation quite profoundly by deciding whether to push or pull data, or who should trust whom.