HI Utpal,
You Can do below things to secure API in apart from Azure API Managment Security
1) Enable Cors
2)JWT Authentication/Any Other Token managment
2) URI Refererer Attribute In Controller/Method Level if Somebody bypass Authentication

Here The Filer will ensure APi should not call directly except from below urls

public class APIRefererAuthorizeAttribute : TypeFilterAttribute
{
string[] origins = null;
public APIRefererAuthorizeAttribute() : base(typeof(ApiAuthorizeFilter))
{

    origins=new string[] { "https://localhost:5500/", "https://xyz.com" };
 Arguments = new object[] { origins };
}

}

For Azure API Managment Level Security , please refer below articles
https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats

https://dev.to/koheikawata/azure-api-management-authentication-part1-1198