Hiding fields from RESTful services?
The only way to do this is using field access (hook_entity_field_access()) and denying view access to fields that you don't want to be visible.

The primary use case that the default rest.module/entity integration aims to support is data synchronization. My standard suggestion for anyone who wants to offer public services on a site or build a custom frontend is to consider writing and defining services tailored for that specific use case.

It's also quite possible that more flexible solutions will be developed in contrib, one of those is relaxed, I don't know if it helps with this specific use case, though.