You have described it well. All I would say is that you need to use the Web Services Data Action integration (because the Web Services Data Dip connector is being deprecated by end of this year), which means you will have to have a web service front-end for the internal database that is exposed to the internet (all PureCloud communications are encrypted and secure).
So, create your Custom Actions to be used in Architect for verifying the IVR entries plus the Custom Action to write the final info to the database, and put it all together in a Task in an Inbound Call flow.
------------------------------
George Ganahl GCP (PureCloud) ICCE CCXP
Principal Technology Consultant
Genesys
------------------------------