Disable the REST API via the site's wp-config.php file.  Use the rest_authentication_errors() filter along with the is_user_logged_in() conditional to limit access to logged in users.  Use the rest_authentication_errors() filter along with cookie authentication to limit access to logged in users.  Use the Disable REST API plugin.