We really were unable to use Kerberos (or any other ASO-related options/features) with Instant Client 11g (see MOS note "Kerberos Troubleshooting Guide" (Doc ID 185897.1 for refs), but this changed in 12c : MOS note "How To Configure Kerberos Authentication In A 12c Database" (Doc ID 1996329.1) textually says :
"
Instant Client:
As of 12c one can uses Instant Client to authenticate with Kerberos using Windows Internal cache. Tnsnames.ora and sqlnet.ora are not provided with Instant client so one needs to set a TNS_ADMIN variable pointing to a directory with sqlnet.ora and tnsnames.ora.
The sqlnet.ora settings are the same as for a thick client:
SQLNET.KERBEROS5_CONF=<path for krb5.conf file>
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_SERVICES=(KERBEROS5PRE)
SQLNET.KERBEROS5_CC_NAME=OSMSFT://
Instant Client provides only libraries and sqlplus utility, the oklist and okdstry utilities are not available so it is not possible to manually request a ticket with okinit.
"
The note speak about Windows, but maybe similar configs could be done in macOS - try and see... And probably, together with Instant Client all the OCI and auxiliar libs must be present, too - see them all on the Instant Client 12c for macOS download page.