When you don't want users to use any web services it seems like you can turn off the permission to Use Remote Interfaces. However that permission does not mention REST.
This made me wonder if there was any way to turn it off, at any level. I did some searching but couldn't find anything.
Besides that, even Limited Access grants Use Remote Interfaces. So as soon as some permissions are broken, they are granted that permission even though the perhaps stripped permission level does not grant it.
So, do you know any way to turn off the possibility to use the REST API? Either at farm level, site level or via permissions. And is there any real secure way to turn off Use Remote Interfaces?