I'd build auth into your endpoints and require a token be passed with requests. Then you can use Web Application Firewall (WAF) rules, if using aws, to throttle or rate limit, etc based on token, and block the rest. You can do it based on IP as well but trivial to work around any motivated bot.