To enhance security, you can restrict community and portal (external) user access to Salesforce APIs through connected apps that are installed in your org. Previously, you weren’t able to restrict only external user access to Salesforce APIs.
Where: This change applies to Lightning Experience and Salesforce Classic in Professional, Enterprise, Performance, Unlimited, and Developer editions.
Who: This feature applies to external users only.
How: Contact Salesforce Customer Support to enable API Access Control for your org. Then enable For external users, limit API access to only installed connected apps. Install a connected app on the Connected Apps OAuth Usage page.