So, to limit access to URLs based on users, you will need to use roles for the users. So, there will be groups under which all users need to categorised. Let's say in a Hospital setting, the roles would be "Patients", "Doctors", "Nurses" etc. And all the users will be under these categories. Django has an open source extension "django-role-permissions" which I have used extensively for many of my projects and I can vouch for. It is easy to handle and has good documentation to get started with.
For limiting API calls, you will need to create a table which accounts for the number of times a specific API is called by a user and use that to limit access.
Link to mentioned library: https://github.com/vintasoftware/django-role-permissions