1 of 3

Is this meant to be used on sites in production?

Yes! Many sites has been already using it.

Is there a security risk to allowing endpoints to be viewed by anyone, such as /wp-json/wp/v2/users/ which shows all users registered to the site?

No! Server responses have nothing to do with security, what can you do with a blank screen/read only access? Nothing!

However, If your sites allow weak passwords, there're some problems. But it's your sites' policy, REST API knows nothing about that.

Is it possible to allow only authorized users to access an endpoint?

Yes! You can do it by using permission callback.

Example from users' permission check callback:

if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
    return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view this resource with edit context.' ), array( 'status' => rest_authorization_required_code() ) );

How do others usually set up this data to be accessed by external applications without exposing too much information?

This question is hard to answer because we don't know what/when is too much information. But we're all using references and cheatsheets.