No, it's not required to authorize at a management group level. But since you'll be receiving security alerts from probably all of your Azure subscriptions, it might just be easiest to do so. This ensure that also newly created subscriptions are automatically in scope of the Logic App to reach out to.

Since I'm writing these blogs in my spare time, and I'm currently very swamped with work and other community engagements, I'm not able to work out the exact details for you unfortunately.

But use my demo Logic App as a starting point, loot at the response from the API containing all the tags, and try to pull out the info you need. I think it wil be a nice exercise on learning Logic App workflows. :-)

Good luck!