I have disabled the REST API with a simple code snippet, no extra plugin is needed, found it here:

https://www.antary.de/2016/12/07/wordpress-rest-api-deaktivieren/