Hello Grim,
Sure, we will be happy to assist you with this. Please find my response below:
1. Can the Google Ads API enable this functionality "as-is"? Or, do we need to customize the API?
Google Ads API has been moved to recently. We recommend to continue running production systems using the AdWords API. While Google Ads API is in “beta”, you may use the new API for testing and development work in preparation for future migration. Please keep in mind that during this "beta" phase, there may be breaking changes in the Google Ads API. To import offline call conversions through AdWords API, you may refer to
this guide which will help you get started.
2. What data fields can we push to Google Ads?
#1 should address this concern.
3. Does the source data need to reside anywhere in particular (e.g. within a specific database)?
This data should be gathered on your end. You may store them in a local database. This
help center article should be helpful on how the call conversion tracking works.
4. How do the credentials work to ensure each client can only access their own call data and not any other client's call data? Do we have to build a security layer on our side to restrict access to the source data?
Could you please confirm if you are referring to the credentials that are used to make the API calls? If so, they will be able to access all the accounts for which the specific user has permissions to. If your concern is different, please elaborate.
Let me know if you have any questions.
Thanks,
Bharani, Google Ads API Team

ref:_00D1U1174p._5001UEHF1g:ref