How can I populate a "user" relation in custom Strapi controller without exposing "find" for all users?

I think I'm misunderstanding something fundamental about Strapi: If I want to populate a query in order to obtain all of its relation fields, I need to activate the "find" portion of their APIs. But that then exposes all of that model to everyone....

For example, I have a model called "articles", that has an associated "user" relation. In my custom article.js controller I am trying to allow anyone to see an article, and the corresponding users's name (but only their name). To do this I have something like:

async find(ctx) {
    const entries = await strapi.entityService.findMany('api::article.article', {
        populate: {
            user: {fields: ['username']}
        }
    });
    const sanitizedEntries = await this.sanitizeOutput(entries, ctx);
    return this.transformResponse(sanitizedEntries);
}

BUT, for this to work I need to enable "find" for the entire user model, which is insecure. Am I missing something obvious with how to achieve this? It seems like a pretty fundamental need in a relational database to allow population without exposing the entire model to everybody.

Thanks