You are right that using the Call API skill will call the api from the Back end as it uses an action behind the scene.
You could indeed create a custom component and inject it in the webchat (assuming you re using the webchat) and call your api from there. There’s another option if you want, every events are posted to the parent page via iframe message posting. You could simply listen to events on the website where you embed the webchat, check if the event type is user_visit and perform your api call from there if you feel more comfortable. Whatever option you choose will allow you to query your external api from the client side but you still need a way to update userAttributes (you can do this in many ways).
I suggest you create a basic custom module with a sigle api route that you can post your results along with the userId (you could even check check user IP and user agent straight from the express request obj). In your module you’ll have access to botpress sdk with which you can use to setUserAttributes
You could also use the webchat sdk to send a custom event with a special type, create a hook in which you check for this event type, from there use botpress sdk to update user attributes with your ip and user agent info.
Hope this helps!