Is it a good way to use different schemas for storing the data and provide data access?
With properly set privileges this can be a good solution.  You can define your stored procedures WITH SECURITY DEFINER, where the role with which you create them has the necessary access privileges to the tables.  Then you have an api_caller role which has only function execution rights for the procedures in the API schema.