JSON URL access restriction within Drupal
Simple answer is - you need to move credentials check and permission check to your Drupal. If app on a person's computer can see all the data, no matter what you do that person can see all the data just as well. So, in Drupal only allow certain role access to that path, and then only populate results with the data user should see.