Hi @Somiya Thanks for reaching out. From the description I believe the actual flow is client -> App Gateway -> APIM -> Backend please correct me if I am wrong here.
in order to limit the request to the API's you can implement Rate limit and quotas policies for more information please refer: https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies
Our data plane security model provides other methods to protect the downstream traffic to APIM and you can use any of them to enforce more restriction, below is a diagram that lists the all the methods we provide:
you can implement any of the above methods in conjunction with the subscription Key to improve the security and enforce more restriction's
https://learn.microsoft.com/en-us/azure/api-management/api-management-sample-send-request#making-the-validation-request
https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuota
Kindly let me know incase of further queries, I would you happy to assist you.
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.