VIN makes the most sense if you can access it from the API.
No, don’t create duplicates. When cars are ingested from the endpoint, search by VIN (or a unique ID) and modify the vehicle if found or create a new car record if not.