I have a situation as follows:
1. Building a public facing site in sharepoint 2016 (enterprise version) with form based authentication.
2. All external users who can access the portal have only "Read Only" permissions.
Problem: External users can access the site user list via api (_api/web/siteusers). This is an information security for the client as the users might be competitors.
Questions: Is there a way in SharePoint to restrict the "siteusers" api endpoint for all the users who have read permission?
If not, then what could be the workaround to achieve this requirement?
thanks in advance!
