a) when accessed, authenticate the user with a static userid/password.
b) will record the external IP address from the HTTP Header of the request (so this will be the IP of the client that accessed the function.)
c) call an external API with that IP.
I would recommend the Azure Functions to use for the above requirements.
Because Azure Functions made of inbuilt/readymade templates related to HTTP Request & Response where you can get the External IP Address (Client IP or User Host Address who are accessing the Function URL.
It's a piece of code we have to write for grabbing this Client IP Address. For example,
#r "System.Web"
using System.Net;
using System.Web;
public static HttpResponseMessage Run(HttpRequestMessage req, TraceWriter log)
{
string clientIP = ((HttpContextWrapper)req.Properties["MS_HttpContext"]).Request.UserHostAddress;
return req.CreateResponse(HttpStatusCode.OK, $"The client IP is {clientIP}");
}
Refer here for more examples on grabbing the Client IPs through Azure Functions.
To call an external API from Client IP or User System, refer here and sharing the Azure Function URL to client makes easy for the clients to see the data retrieved from that function URL and also, we can differentiate the amount of data to be displayed for the users based on provided authorization level.
There are a lot of Authentication options provided by Azure Functions like:

If you have any static passwords, then you can store them in Azure SQL Database securely or Azure Key Vault is used to store the SSL Certificates, Passwords, Key-Values securely and retrieve from them to the Azure Functions securely.
Refer these Azure Functions OAuth2 from email / password stored in the database and also can secure the data based on access/authorization levels, for this refer here.