I don't think it is possible without opening the browser completely. What would be the best option is to make a deeplink which is accessible to anonymous users, so your user does not have to log in. Let the microflow do the process you need and just provide a feedback message to the end user, like: ‘Thanks for activating your account!’. I think this will achieve what your looking for.
Hope this helps!
Sure it is. You first need to create and publish a service in your app that does activate your object. (So, not using /link but /rest)
That makes it possible to call the service using Postman, or Soap, or curl.
Then: how to add this to an email. I am not sure, but I think you can add the curl-command in the mail.
For security: Make sure you add credentials, a time-slot and other security measurements.
Btw. due to phising, everybody is very reluctant to click on any link in an email.