I need to call an API for authentication when the user clicks on my tab to load the data and control the visibility of the buttons.
I'm not aware of a "tab changed" event, but you can use other events like ApplicationReadyEvent and PortalSignOnChangedEvent, depending on when you want to call the API.
It's not possible to hide buttons on the ribbon, but you can enable/disable them based on states and conditions defined in DAML and activated in code. See the wiki for examples.