I am trying to create a device management system for over-the-air updates. The system basically has 3 parts:

1. Mobile client devices running android located at different places
2. REST Backend written in Java using Jersey Framework running on Google App Engine. 
3. Web front end running on the browser of the users.

The use-case/flow is:

1. Each mobile client has some information about itself including a unique device ID. The client is also programmed with credentials to enable to access the REST API to create, update itself.
2. The REST Backend stores the details of the devices in a database(in this case google datastore)
3. The web interface can be used by the user to view details of the devices and perform operations on it.
4. The devices send periodic heartbeats to the REST Backend, in response to which it can send commands if any operations was requested by the user.

Now the problem is that, there are certain details regarding the device, lets say for example the city, country where it is located is not available with the device.

It is available with some other service which has APIs which takes the device ID (or a list of device IDs) and returns the details corresponding to it.
When the user want to see the list of devices:

1. These additional parameters like city, country which are not sent by the device should also be shown.
2. It should also be able to filter/group devices and perform operations on them. For example, user may want to perform operation X on all devices in London.

So my questions is basically where and how is the best place to get the details.
I had initially thought that it can be done at the web client, meaning if the users wanted to see all device in city C:

1. The web client makes a REST API call to get all the devices
2. Then it takes the list of deviceIDs from the response and makes a API call to the other service to get the additional details.
3. It filters the response(with some javascript code) where the city is C and then shows it to the User.

However, I think that this approach is not correct since it involves quite a lot of processing at the client browser. Also if the number of devices increase, it will lead to issues.

So does there need to be something in between the web client and the REST backend which actually makes the REST APIs calls and does all the filtering and then provides the result to the client browser? If yes, then where should it sit and what types of APIs/interaction should it have with the client?

What is the best way to handle this?