It appears that this is the way to do it, yes. It is explained under template usage here https://www.advancedcustomfields.com/resources/google-map/. I don’t know anything about protecting the key. I actually use a different plugin for google maps gut the key is easily available in the source of the page. When I set up the key I set it up so that it can only be used by specific domain names.
