Remove the User endpoints from the WordPress Rest API

.htaccess

<IfModule mod_rewrite.c>
  RewriteEngine On
  
  # Block _method=GET query string used for compatibility in the REST API
  # See https://developer.wordpress.org/rest-api/using-the-rest-api/global-parameters/#_method-or-x-http-method-override-header
  RewriteCond %{QUERY_STRING} \b_method=GET\b [NC]
  RewriteRule ^ - [F]
</IfModule>

functions.php

<?php
/**
 * Remove default WP JSON API routes dealing with lisitng users
 *
 * @param array $endpoints The endpoints to modify
 */
public function filter_rest_endpoints( $endpoints = array() ) {
    $keys_to_remove = array(
      '/wp/v2/users',
      '/wp/v2/users/(?P<id>[\\d]+)',
    );
    foreach ( $keys_to_remove as $key ) {
      unset( $endpoints[ $key ] );
    }
    return $endpoints;
}
add_filter( 'rest_endpoints', 'filter_rest_endpoints' );