As of now, if you create an OCP Channel App, which has a field on a form, which gets data from another source, it is not possible to configure any type of authentication for that request.

It is also not possible to implement internal endpoints to be consumed on the forms, so that they would not be open to the public network at all.