Removes user endpoints from WordPress REST API

put-inside-functions.php

<?php
/**
 * Remove API Endpoints
 *
 * Clobber API routes to remove them from public access.
 */
function remove_wp_json_api_endpoints($endpoints) {
	$toRemove = array(
		"/oembed/1.0/embed",
		"/wp/v2/users",
		"/wp/v2/users/(?P<id>[\d]+)",
	);

	foreach ($toRemove as $item) {
		if(isset($endpoints[$item])){
			unset($endpoints[$item]);
		}
	}

	return $endpoints;

}
add_filter('rest_endpoints', 'remove_wp_json_api_endpoints');

Updated to be slightly more extensible.