Is it possible to authenticate to Salesforce and submit a payload to POST method of an apex class exposed as REST resource, all in a single call? I know this usually need 2 different calls, first to login and get a token or session id and the second one to submit the request to the resource. However this external system seems to have some limitation they cannot make a second call. Is there a workaround to achieve above without having to compromise security?
Though this is not possible out of the box with the Salesforce REST API, you could design an Apex REST Service exposed on a Force.com Public Site.
Normally, this would mean your REST service is open to everyone. But your Apex controller can use the Crypto namespace to parse a signed JSON Web Token that your integration could pass with every call.
This is different than using the JWT Bearer Token flow in Oauth 2 which still requires two calls.