Sounds like you are already far with having the concepts - so it's only missing what @AndrewMBaines mention. The magic sauce in the this final part is that you have to have the ID parameter to be locked so that it requires to be signed with a jwt token in your Drupal embedding code. Refer to the official docs pointed to on the Wiki I mention below.
No need to use node.js you can do it with PHP code as well. If you search https://discourse.metabase.com there are plenty of examples of embedding - here's a wiki collecting various pointers (contributions on that page are welcome BTW 
): WIKI: SDK (covers API, embedding etc?)
Here's another fairly recent updated thread regarding PHP embedding with SECRET (HOW TO?) related to Wordpress, not Drupal though.