>Is this meant to be used on sites in production?

Yes. [Many sites has been already using it](https://make.wordpress.org/core/2015/07/23/rest-api-whos-using-this-thing/).

>Is there a security risk to allowing endpoints to be viewed by anyone, such as /wp-json/wp/v2/users/ which shows all users registered to the site?

No. Server's responses have nothing to do with security, what can you do with a blank screen/read only access? Nothing!

However, If your sites allow weak passwords, there're [some problems](https://codex.wordpress.org/Brute_Force_Attacks). But it's your sites' policy, REST API knows nothing about that.

>Is it possible to allow only authorized users to access an endpoint?

Yes. You can do it by using [permission callback](https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/#permissions-callback).

For example:

	if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
		return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view this resource with edit context.' ), array( 'status' => rest_authorization_required_code() ) );

>How do others usually set up this data to be accessed by external applications without exposing too much information?

This question is hard to answer because we don't know what/when is *too much information*. But we're all using [references](http://v2.wp-api.org) and [cheatsheets](https://www.owasp.org/index.php/REST_Security_Cheat_Sheet).