This can be done, and we have customers that are using mendix in this way. Licensing is the same as for normal Mendix use. User authentication and authorization can also be same, for tokens/jwt authentication you can have custom logic using headers to validate the tokens and map to a mendix user. Roles is also the same.
Fastest way to create APIs for your data is OData REST, this will create REST APIs will full CRUD capabilities, and filtering, sorting, pagination, and nested responses. As of 10.14 Mendix also provides an experimental feature to use the same OData REST APIs using GraphQL. For more details see: https://www.mendix.com/blog/mendix-release-10-14-connecting-the-dots/#mendix-connect