Cache rules for a static tool page with a per-request JSON API?

Hi all, I run a small free web tool, Comment Viewer, where you paste a TikTok, Instagram or YouTube link and the page lists the public comments and replies (with a CSV export). The HTML/JS shell is fully static, but the comment data comes from a JSON endpoint under /api/ that changes on every request.

Before putting it behind Mlytics I'd like to confirm the setup: is it enough to send Cache-Control: no-store on the /api/* responses and a long max-age on the static assets, or do I also need an explicit bypass rule for that path in the console? And does the edge respect Vary on query strings, since each lookup is keyed by the video URL in the query?

Thanks for any pointers.