I am developing integration in Salesforce with external application. This app uses my api by OAuth password flow. For this I have created user and profile, restricted access to all tabs etc. Are there more options to restrict UI actions? Like allow login via api only?
Yes, you can do following things to restrict integration user depending on your needs.
1) You can make that user as API only.
2) remove access from all unrelated objects from his profile
3) remove modify all , view all permission
4) makes sure there are not any permission set assign to integration user
5) makes sure role as low as possible.