How do i verify users passwords from the hash in the database without drupal core logic
A long time ago, I had to move from one system to another and there was a similar concern about migrating hashed passwords. I set up things to check for a password in the new system. If one exists, authenticate against it. If not authenticate against the old system, as it seems you're already doing with Drupal. However, instead of just handing out the cookie, use the opportunity to store whatever was sent in the new system, or physically take the user to a "verify your password" in the new system, and get it saved properly there.