Hi @Mudasar Syed,
You need to first decide which route you are going to take for connectivity. Make sure you keep a security on top priority since you are dealing with user profile service.
This article covers the very basics of different options available to you:
https://blogs.msdn.microsoft.com/jennifer/2015/02/26/different-ways-to-connect-azure-to-on-premise-d...
You can also expose the User profile service end point via https (reverse proxy) and filter incoming connections for certain IP address range.
As far as your API options are concerned you can always refer to this article from MSDN:
https://msdn.microsoft.com/en-us/library/office/jj163800.aspx
Let me know if this helps.
Regards,
Jasjit
