Your app will only use one of those IP addresses at a time, but it could even change between different deployments. If you need to whitelist an IP, you should whitelist all three. Make sure you secure your API with another method beyond just the whitelist!
As for your cache question:
And this information is not correct. Mendix does not guarantee static IP adresses. Yes, the IP adresses seems to be quite constant but that is not a guarantee. They might change without Mendix telling you (Edit, they changed this part. They now seems to tell you 48 hours in advance).
See this part in the documentation:
Incoming IP addresses are liable to change without notice and should not be used to access the application.
Mendix will endeavor to maintain the current outgoing IP addresses. However, they may change for operational reasons and this is subject to a 48-hour notice period.
Mendix uses the static IP addresses. It depends on the Mendix cloud region – For details, Refer https://docs.mendix.com/developerportal/deploy/mendix-ip-addresses
If you need further information, please file a support ticket with Mendix Support.