I have a custom Connected App configured in my org.We have an Integration profile with limited access and an Integration user(dummy user created just for connected app) .We have a 3rd Party application outside the SF system which makes Restful calls using this connected app. When it comes to User impersonation, We do not see any restriction at the OAuth level where I can restrict Users who can connect via this connected App. If I Set OAuth Permitted User to Admin Approved and set Profile restriction then any User other then that Profile Users can't access the system from 3rd party app.
Also what does the OAuth Usage actually show? I am not seeing any entries under OAuth Usage for the Integration User who is accessing the System via this connected app but I see User level Login history.