Best way to restrict web services?

What is the best way to restrict web services access to Sugar?

I'd like to control which users can use APIs to access Sugar from outside the SugarUI.

thanks
FrancescaS