add_action( 'rest_authentication_errors', 'disallow_user_rest_access_to_users' );
function disallow_user_rest_access_to_users( $access ) {
   if ( ( isset( $_REQUEST['rest_route'] ) && ( preg_match( '/users/', $_REQUEST['rest_route'] ) !== 0 ) )  {
     return new WP_Error( 'rest_cannot_access', esc_html__( 'No Access to User endpoint REST API.', 'mytext' ), array( 'status' => rest_authorization_required_code() ) );
   }
  return $access;
}