How can I hide nodes from view, but open access to JSON:API at the same time?
If you're working with unauthenticated consumers, the Rabbit Hole module has the means to disable node/* routes without using the user role/permission system. 

The Rabbit Hole module has a sub-module Rabbit Hole nodes that, when enabled, will let you disable node/* routes. This should leave open your jsonapi/* endpoints to anonymous consumers.