If you've got the username and password to log the user in to Moodle, generating them a web service token isn't necessary unless you want to use it make web service calls as that user. If you want to be fully logged in to a Moodle session, you need to make some request in the user's browser that sends the username and password to Moodle and follows the login process.
I'm not enough of an expert in SSO to be comfortable offering specific advice, since there's likely a tradeoff between security and convenience if you're doing this yourself, unless you're planning to implement a full standards-based solution. Some options might be to create an alternative login script in Moodle which you can send the username and password to, or to implement an auth plugin which accepts some token genereated when users log in to your student portal.