Based on this question: Securing a REST API and this one How to limit an access to specific REST endpoint? it seems that the only way I can limit access to specific custom endpoints is to create multiple API users. Currently we only have one API user for our connected application, but we were hoping to make the process more secure by restricting access to certain APIs depending on which connected 'app' was connecting. We created multiple Connected Apps in Salesforce to be dedicated to specific functions, but all requests actually originate from the same app (just different areas within the app).
The above linked questions are 2 years old, so I am curious if this answer still holds true. Do I really need to create multiple API users if I want to restrict access to specific custom REST endpoints? Or can I somehow limit a specific connected app to only have access to a specific subset of endpoints? Seems kind of unfair to make us waste valuable user licenses just to make our APIs more segmented, no?
If the answer still holds true, is it possible to add additional security to my endpoints by somehow checking programmatically to see what connected app initiated the request, and kick back an error message if it didn't originate from the correct connected app (client key/secret combo)