Is it possible to mask / hide / encrypt fields for a technical user calling Workers API Rest HCM ?

We need to provide internal users with access to our REST API, but we also need to control what each user can view or access. This is important because some information is sensitive and visibility should depend on the user’s department.
Is there a way to implement this kind of access control? Alternatively, would it be better to restrict certain users to calling specific SOAP reports that we create for them? We are also open to any other approaches that could help us manage access securely and efficiently.