It would be better for users (and policy) if they don’t have to leave Twitch for this. But thats up to your for the most part.
Yes, domains need to be added to the “Capabilities” section
Connections to firebase for database stuffs are not governed by CSP. The connection just needs to be over SSL