I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

Question

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible.

My approach is as follows and I am asking for feedback on whether i am making a mistake here in my thinking.

1. Client can authenticate with an Oauth provider.
2. Client receives encoded JWT.
3. Client sends signed JWT to service.
4. Service verifies JWT. Since my service is not an Oauth based service I dont provide an access token.
5. Instead I send back a stripped down version of the JWT with HttpOnly, SameSite Strict cookie.
6. Client never keeps the original JWT anywhere.
7. For authorization i simply look at the provided cookie.
8. I use POST for state-changing operations and never GET to adhere and derive the benefit of SameSite.
9. I can ignore CSRF tokens because SameSite gives me the benefit of not needing to use Double Submit (Header + cookie)