Yes, you can call the login without any permissions.

You can read more on how to implement for web apps in the usage for web applications section.

https://github.com/greenart7c3/Amber#usage-for-web-applications 

 Are there plans for nip46 in amber? 

 No, amber is a offline signer.
For nip 46 there's nostrum, but I haven't tried it

https://github.com/nostr-connect/nostrum