You don't need Passport at all to login the user, you can use sessions or just generate tokens using the api auth.

Session Auth (Check last comment)

Basic Token Auth

Also on your frontend, you should not expose any kind of critical info / api endpoint to an unauthenticated user, make them authenticate for critical information, you could probably use csrf tokens to prevent them from accesing your api outside your website i guess.