The Authorization Code grant type is the appropriate choice for an OpenID provider that does not expose tokens to the end user. This is because the Authorization Code flow ensures that the tokens are delivered directly to the client application via a secure back channel, allowing the application to securely exchange the authorization code for access tokens without exposing them to the end user.