RE: Dynamics CRM 2011 on premises.
Hi M.,
The first question is, is the api going to be stored on the same server as the CRM Server. If so, that is not recommended, but you have to go with what you have. If you can host it on a different server, maybe put that server on the DMZ, for access.
As far as the development, what we have done previously (in 2011) is create WCF services and host them on an app server. You can also create an API that would consume the CRM WCF Services. The WCF would be called from the public web site and query/update the CRM WCF Services. Make sure that your WCF Services are not using a System Administrator account, but an account that provides the users only the proper access that they need.
I assume the web site that will consume the API will be using anonymous access. If that's the case make sure that you are encrypting the credentials on the app server.