Yes, you should indeed create a plugin, and define a controller method that fetches the data for you.
Then, from the frontend code, call the controller method, which injects the bearer token server side, inaccessible for any third party, and makes the call to the external API.