allow public access to entityRef field contact lookup
The Access AJAX API permission was added in CRM-8840 to get around the firewall of sorts that surrounds the API unless you have Access CiviCRM.  If you don't have either, you'll get blocked trying any Javascript call to the API, regardless of your other permissions (whether granted via hook, ACLs, or CMS).  

As best I know (and I just did a quick test on a dummy site), all of the APIs require Access CiviCRM or Administer CiviCRM even beside the blanket requirement for Access CiviCRM or Access AJAX API.  While adding Access AJAX API will get your foot in the proverbial door, you won't have the ability to do anything.  You'll want to write a hook to change the permissions in the specific cases that you need to run an API call.

So yes, you're on the right track, and no, there shouldn't be any immediate negative consequences of adding Access AJAX API.  However, since it removes the outer layer of security against the API, you'll just need to be sure everything's configured tightly.