Can a notification have a button to open a specific request but require recipient to log in before editing the request?

You are using an "everyone on the internet" user in the app.  In order to force a QB login, you will need to restrict the edit permissions for that role.

This might affect other reasons you have the open to the internet role, but you know your situation the best.