Tl;dr: Mutations in GraphQL seems to be the way to go - but GraphQL in Craft doesn't yet support mutations on Commerce elements. As for now, you have to create a Craft CMS Plugin.
Alternative 1 (sort of)
According to #9667 - the 3rd party CraftQL-plugin lets you do CRUD on everything* via Mutations (GraphQL way of altering data) - so that's an alternative while we wait to the native GraphQL functionality to support Mutations (see https://github.com/craftcms/cms/issues/4835 for status on that one. It's a part of the 4.0 milestone)
Also, Pixel & Tonic has added support for Mutations to the 4.0 milestone for Craft CMS on the built in GraphQL plugin. So it's coming.
* Well, not everything. CraftQL supports the following entities: entries, sites, draft, assets, globals, tags and users. The documentation contains a section about third-party field support that probably lets you implement support for mutating Craft Commerce-fields and other 3rd party fields.
I've added a Feature Request on Craft Commerce regarding GraphQL and mutations. Let's see what they answer.
Alternative 2 (only real alternative in 2019)
Also, if you can't wait for mutations in Craft Commerce, you can create your own Craft Plugin. Have a look at my question "How to accept incoming Webhooks", which helps you along with creating a plugin that can do things like creating and modifying products in Craft.