Correct, Twitch host the frontend and you host whatever backend you need. Any updates to the frontend need to go through the review process but your backend server is under your control so you can do anything you like with it.
You can make API requests from the frontend, either to Twitch, your backend, or other services, but it MUST be over HTTPS, or WSS, so if you need your frontend to send requests to your backend you need to ensure you have the required SSL certificates.