I have had issues with the new GitHub tokens, so for now, I think I would recommend against using them. Glyphs is using libgit2 for its Git-handling, including cloning. Check which protocols libgit2 likes, maybe HTTP (no S) is not supported, and maybe there is a way to make git: or ssh: work with libgit2.
For your needs, would it be enough to have a distribution method not involving Git? So, a way where Glyphs would download a zip file whenever it updated so similar? Just for planning future ideas …