>Is this meant to be used on sites in production?

Yes! [Many sites has been already using it](https://make.wordpress.org/core/2015/07/23/rest-api-whos-using-this-thing/).

>Is there a security risk to allowing endpoints to be viewed by anyone, such as /wp-json/wp/v2/users/ which shows all users registered to the site?

No! Server responses have nothing to do with security, what can you do with a blank screen/read only access? Nothing!

However, If your sites allow weak passwords, there're [some problems](https://codex.wordpress.org/Brute_Force_Attacks). But it's your sites' policy, REST API knows nothing about that.

>Is it possible to allow only authorized users to access an endpoint?

Yes! You can do it by using [permission callback](http://v2.wp-api.org/extending/adding/#permissions-callback).

Example from [users' permission check callback](https://github.com/WP-API/WP-API/blob/develop/lib/endpoints/class-wp-rest-users-controller.php#L85):

	if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
		return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you cannot view this resource with edit context.' ), array( 'status' => rest_authorization_required_code() ) );
	}

>How do others usually set up this data to be accessed by external applications without exposing too much information?

This question is hard to answer because we don't know what/when is *too much information*. But we're all using [references](http://v2.wp-api.org) and [cheatsheets](https://www.owasp.org/index.php/REST_Security_Cheat_Sheet).