According to the official WordPress recommendations you should not disable the WordPress REST API as this will break the “WordPress Admin” functionality.
For example, the WordPress Block Editor requires the WordPress REST API and if you disable it you won’t be able to publish or update your posts anymore.
However, you can use a filter to require that API consumers be authenticated, which effectively prevents anonymous external access. (more…)