It is indeed necessary for each multichaind node to be configured to accept incoming API connections from your web demo.
I don't know exactly what you're planning, but if this means that each user of your system is providing their node's IP address and API credentials to your web server, then this is a very insecure setup, and is only suitable for demo and testing purposes.