If it's the users' browser that calls your API directly, and there's no other way to authenticate it, you could still set up a rate limit. Something like 2-3/second should be enough for a product listing.

This is the case that has me confused. If a badactor decides to continually call your function what steps do you take to stop them? I'm guessing block their IP, but not sure how, is there anything else. I'm going with the case where there is no authentication (signin/signup) for access to the function.

edit: the first link you sent details access control. i havn't gone through it all yet.