With API Access Control, you can lock down all connected apps' access to Salesforce APIs and then approve (allowlist) specific connected apps. Using profiles and permission sets, you can then grant users access to an approved connected app. These users can access APIs through the connected app.