How to apply authentication to rest endpoint URL?
Since rest callbacks run through Drupal's normal roles/permissions layer, you can just disable the View published content permission for anonymous users, then they won't be able to fetch the JSON for the View.

If you need finer grained control, you'll have to use hook_node_grants().