How do you limit access to certain records within an API REST role?

Summary:

Business is looking to call employee records, to verify they are still an active employee, and their home address within certain states via REST API call.

Content (required):

Employee name, person number and home address but EXCLUDE anyone who lives in California.

Can you place a data security on the role to exclude/include certain states? If yes, how?

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):