Get Embedded Token but only for grant access to specific Workspace

My understanding is that for PowerBI Embedded you should have a specific user that is used by our software to get an authenticationToken so that a dashboard will load in our ISV application.

I believe that this authenticationToken gives the user access to all PowerBI reports and all Workspaces that that user has access to. Is it possible to limit the scope of the authenticationToken so that it can only access a specific report or workspace only?

Looking through the documentation I cannot see where this is possible.