If your concern is restricting access, we recommend exposing ‘/api/v1/osquery’. That way, you're covered for any changes going forward as new features may be added. Here's a list of the current endpoints:

/api/v1/osquery/enroll
/api/v1/osquery/config
/api/v1/osquery/distributed/read
/api/v1/osquery/distributed/write
/api/v1/osquery/carve/begin
/api/v1/osquery/carve/block

Hope that helps!