There is no separate API security. If you can run a report from the web portal you can run it using the API. In fact the whole web portal is built on top of the APIs so if you blocked access to them the web portal would not work.
So you will probably need to start a discussion with these users. If they have a genuine business need then there might be a better way of extracting the data they are after. Or you may be able to organize a better time for them to run their reports.
Worst case, ,if they refuse to listen you could just revoke their access entirely... but in my experience I've never had to go that far. It's usually possible to find some middle ground. Usually the users are just trying to get their job done and did not realise the impact they were having. Maybe getting the users to talk to the DBAs would help - I've had DBAs who were happy to schedule extracts for users outside of busy times. Then everyone was happy.
