An API access token will be able to access whatever items in Smartsheet that the user who owns the token can access. So, to restrict an access token such that it can be used to access only certain items requires that you restrict what its owner can access.
By default, any user that is shared to a workspace can access all items in the workspace. However, itβs possible to instead grant a user access only to specific individual items in a workspace (instead of 'sharing' an entire workspace with the user, which would grant them access to everything in the workspace). See this article for more info on that: https://help.smartsheet.com/articles/520104-share-sheets-reports-dashboards#Workspace_Sharing.