Create annotation to validate JWT in Spring controller instead of filter
I'd prefer the filter, just because then you don't have to worry about a missed annotation leaving your API wide open. I never found decoding JWTs to be expensive, and I suspect you're performing premature optimization.
value isn't especially descriptive. Perhaps @Authorize(users= would be better.
Your code can be simplified by returning early if a match is found, rather than counting failures and comparing them:

final JwtProperties jwt = JwtUtil.validate(webRequest.getHeader("Authorization"));
final String currentUser = jwt.getScope().get(0);

for (final String allowedUser : parameter.getMethodAnnotation(Authorize.class).value()) {
    if (allowedUser.equals(currentUser)) {
        return jwt;
    }
}

throw new UnauthorizedAccessException("Un-authorized access", 0xd1561);