Let's assume I have an REST ednpoint created:
@RestResource(urlMapping='/CUSTOM_DATA/*') global with sharing class MY_CUSTOM_DATA
Now I am going to create Connected App with Full Access scope, I will get credentials, then I choose basic: OAuth 2.0 Username-Password Flow
So I will provide external user with credentials, password and username.
My question is, how can I restrict access just to MY_CUSTOM_DATA class? It's enough to create profile with restricted access to this class/objects?
I want to be sure that external user will not have access to sf database and objects.