I've done some experimenting with user rights and that part seems pretty straight forward.

I did some more experimenting, this time on calling the TTS server through the wiki. This wasn't too hard to do, by creating a new API action that just sends requests through to the server. This should be able to limit the access if 1) you can limit who is allowed to use certain API actions on the wiki and 2) you can restrict requests to the TTS server to only be allowed from the wiki. I haven't looked into these yet, but I feel like they should be doable.

At least 1) looks doable:

There are several ways to restrict usage of (certain parts of) the API to certain groups of users, or to disable it altogether.

https://www.mediawiki.org/wiki/API:Restricting_API_usage

I think that I've managed to limit the access to the API, but I'm not 100% this is how you're supposed to do it. I posted on Discourse hoping to get some help on this.

I got help from @Tgr and will use the ApiCheckCanExecute-hook.

I have what looks like a working WIP locally. It still needs cleaning up and tests.

Is it possible to allow every user, even if not registered?

Yes, you can give the rights to the "*" group to allow that.

Change 570042 had a related patch set uploaded (by Sebastian Berlin (WMSE); owner: Sebastian Berlin (WMSE)):
[mediawiki/extensions/Wikispeech@master] Add API action for requesting speech synthesis

https://gerrit.wikimedia.org/r/570042

Change 570042 merged by jenkins-bot:
[mediawiki/extensions/Wikispeech@master] Add API action for requesting speech synthesis

https://gerrit.wikimedia.org/r/570042

Mentioned in SAL (#wikimedia-cloud) [2020-04-07T08:34:28Z] <wm-bot> <sebastian-berlin-wmse> !log wikispeech Deploy latest from Git master: 85fa89a (T244344, T244345), f79fe03, 956e507, 66da277, 18c20c7 (T246085), 044eba0 (T249207), 2f98bef (T203161), 7aa7556 (T245823), 43e26a2