Eloqua API User AOuth connection x App Cloud Developer

Hello Eloqua Team :)

I would like to clarify how to correctly configure OAuth access in Eloqua with limited permissions.

Our goal is to create an OAuth connection that can read Segments (and all contacts)only via the REST API — without access to other Eloqua assets such as emails, campaigns, or forms.

Could you please confirm:

1. Whether OAuth access in Eloqua can be limited by asset type (for example, read Segments only), and
2. If not, whether the recommended approach is to create a dedicated Eloqua user with restricted permissions (assigned to a custom security group) and use that user to authorize the OAuth app.