In order for your custom profile not to have access to Source code (or any other setup items), you need to disable the View Setup and Configuration permission on the profile. You may also like to disable the Author Apex permissions to make sure the Users on the profile cannot create/edit any apex or triggers.
This is usually a good practice to restrict any custom profile which is not supposed to have administrative privileges.
For Users on that profile to be able to call Apex exposed as REST API (or any other API), the permission that is required is API Enabled.
You will find more details on different permissions on the documentation here.