How to check the user logged in - from direct login or using api access or using Oauth? If so can I block that user accessing certain objects?
Can I check the above using AuthSession object's sessiontype? or is there a way?
Once I find the user how he/she is logged in, how can I restrict the user to access only a few objects (for example Account, Contact and Opportunity only)
You can't "block" access, but instead you would "grant" access. To do this, use a Login Flow. You can determine their session type by way of the login flow variables presented to your flow, and, if they meet certain conditions, provide a Session-Based Permission Set to access additional features. The base profile would only have limited access (e.g. Accounts, Contacts, and Opportunities), and additional access if the Login Flow grants access via the permission set.
