I’m not aware of a documented web API into iCloud photos. Not past the iCloud Photos website.
Bypassing two-factor authentication is going to continue to be an issue with any access control based on an Apple ID.
Export all photos or specified photo album(s) into your app, or export into a different photo-hosting service, or configure the photo album(s) for per-user sharing, or set up a shared photo library. The shared photos or shared albums aren’t particularly compatible with a web app, though.
If a Mac is involved, a Mac native app—probably not a web app—can potentially be used to access and serve the photos, or to stream the photos to some other display. Or to some other web service.
Pretty much any Apple ID used for access control is going to have two-factor enabled though, which means shared photos that are restricted to specific Apple IDs—not globally accessible—will still need two-factor.
General info:
How to use iCloud Shared Photo Library - Apple Support
Web-only access to iCloud - Apple Support