So the expectation is for client applications to directly connect to the API. But of course that's not required.
You can use Foxx to host your entire server-side application inside ArangoDB in some cases but in our experience, the best approach is having a middleground where the data-intensive server-side code lives in Foxx services and the client-facing part (e.g. server-side rendering) exists outside of it.
Foxx offers you the option to put backend logic directly inside the database; it's not an all-or-nothing decision.