Clarifications needed regarding MIP

Hi guys,

Need some clarifications regarding the Microsoft Information Protection (MIP) functionality,
1. Is the Certificate Based Authentication (CBA) applicable for both Native App as well as Web App/API?
2. Using MIP, is it possible to apply the Protection without labeling?
3. We have a Windows Service that will be installed in a Windows Server machine. Please suggest a suitable option "Native or Web App/API" for registering a Windows service in Azure portal? 

Please clarify. Thanks in advance.

Best regards,
Rajalingam Boopathy