Technically, to achieve license attribution for Apache License 2.0 one must ensure that users of the software can read the full License and Notice files (i.e. the License and Notice files should be included with the deployment and be accessible, License can be in short form). In an Android app that can be as simple as dropping them into
assets folder, which can be accessed by unzipping the apk or using the relatively new OSS Licenses Plugin . For web, making them available in a licenses folder that is publicly accessible would suffice.
Note that your software doesn't have to be packaged or have an installer to be classed as "derivative work", any software that utilises a library/code that is licensed under Apache License 2.0 is derived from that library/code.
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the
purposes of this License, Derivative Works shall not include works
that remain separable from, or merely link (or bind by name) to the
interfaces of, the Work and Derivative Works thereof.
The clause "For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof."  it would seem that integrating with a SaaS library would fit that case, or in your case linking to externally hosted material icon files. The existence of Google's OSS Licenses Plugin suggests that including a library while only utilising it's interfaces still falls under "Derivative Works".
Assuming you hold the icon files on your server/in your infrastructure, your web app is effectively redistributing parts of the work.