As you noticed, you need to install a script to run when the user accesses it to receive his email. Then, instead of directly accessing the calendar (which you obviously cannot), you can call another script published, but executed as yours, allowing anonymous access to receive this request from the script “view” and create calendar events for it.
After publishing this "background" script, get its url and use it when calling UrlfetchApp.fetchto it. Then pass the parameters as url parameters (or to the payload if you prefer to use postinstead get).
script ContentService, script.