Securing and configuring Azure Service Bus for public facing webapp (using B2C) to call downstream APIs and services using AAD

Lets answer your questions one after another which you have.

The first question

How should a public-facing portal be setup to be able to push data down into a queue or endpoint ?

For this first we need to use a Web API to push data to Azure Service Bus Queue. You can create a new ASP.NET Core Web API project and install Azure Service Bus NuGet package. Check this document for the way to do it.

Then we can use Service Bus Queue trigger Azure function to read the message from the queue and the process it or store it depending on the requirement. Check Azure Service Bus trigger for Azure Functions for more information.

The second question

How can calls to specific API endpoints and microservices to and from the webapp be secured from the public FE ?

We can achieve this requirement by securing the front end using Application Gateway. We need to configure Application Gateway in front of the Web API.

Check this Configure App Service with Application Gateway document from Microsoft for more information.

Lastly, the third question

How would this be configured in terms of authentication, app reg etc.?

In this case we can use Azure Managed Identity. Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication.

So, we can use Azure Managed Identities with the Azure Resources like AKS. Check this Use managed identities in Azure Kubernetes Service for more information.