3512808 - Access Restrictions for applications calling accounts.getJWT

Client would like to restrict console application full API access when using access token:

An application in our landscape wants to make a server to server call to get the id_token by calling the accounts.getJWT API as they are not passing user credentials(password).
But for the application to be able to call this API, "Full API Access" seems to be needed in the permission group.
Since this gives access to other APIs as well,
1.Is there a way to limit the application access to only few required APIs?
2.Are there any other APIs which can return id_token but do not need Full API Access to be configured in CDC?

SAP Customer Data Cloud

CDC, token, Customer Data Cloud, getJWT, console application , KBA , CEC-PRO-API , Core REST API & Server SDKs (JWT / PHP / Java) , Problem