users_rest_secure_wp.php

<?php

/*
 * Disable users REST endpoint for public or not author users users
 * To access the endpoint the user must need to be contributor
 * aka need to have edit_posts permission
 */
add_filter( 'rest_endpoints', function ($endpoints) {
    $endpoints_to_remove = array(
        '/wp/v2/users'
    );
    
    if ( !current_user_can('edit_posts') ) {
        foreach ( $endpoints_to_remove as $rem_endpoint ) {
            foreach ( $endpoints as $maybe_endpoint => $object ) {
                if ( stripos( $maybe_endpoint, $rem_endpoint ) !== false ) {
                    unset( $endpoints[ $maybe_endpoint ] );
                }
            }
        }
    }

    return $endpoints;
} );