Hello @Roy,
welcome to this moderated Azure community forum.
You basically want to have explained how a complete IoT platform architecture would look like.
If you are able to use the Azure IoT Hub as cloud gateway for the devices, you only have to add a website with SignalR (for live two-way communication between app browser frontend and server backend). just forward device-to-cloud telemetry messages to to the backend (so these are routed to the right user via SignalR hubs) and forward cloud-to-device commands to the devices via the IoT Hub.
If you are not able to use the Azure IoT Hub, the Eventgrid Namespace MQTT broker is a nice alternative but then you need to connect the broker to the webserver backend, probably in a stateful way.
A way to do this is making use of a container instance as described in this blog post.
Other Azure cloud gateways solutions are not really designed for IoT devices so these lack ability to register and manage devices, each having its own credentials.
The way you describe provisioning seems a challenge: you need already a secure channel for each device before it can get a certificate to secure the channel... Regarding automatic provisioning, only the IoT Hub offers a provisioning scenario using the Device Provisioning service. For other services you need to 'touch' each device so you can provide it its own credentials.
If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.