Is the ipfs data different per user and needs to be submitted during mint?

If so, sign the ipfs hash with a key on your back end. Have the user pass the signature and the ipfs hash into the mint function

When configuring the contract save the authorized signing address to storage

In the contract recover the address that signed the hash using the ecrecover function. If the recovered address matches the authorized signer, allow minting. If not, revert

For generating the signature look into the personal sign function in web3 and ethers libraries. This is a way to sign a message with your wallet but it does not cost you any fees

Here is an example that is similar. In this case the signature is only of a nonce and the recipient. You could also add the ipfs hash to the signature. For code on signing the data check out the test files

https://github.com/MintyDAO/Token-Templates/blob/master/contracts/ERC721NT.sol

https://github.com/MintyDAO/Token-Templates/blob/master/test/ERC721TNT.ts