Here is some elaboration on H102’s answer.
OH has lots of UIs. Each UI is really it’s own project.
There are two different types of UIs. Administration UIs and Home Automation UIs.
Administration UIs (PaperUI, Habmin) are used by you, the developer of your bespoke home automation (HA) system to create and administer your system. This includes things like installing add-ons, configuring Things, and stuff like that. Only you as the developer of your HA system will use these UIs. These UIs are pre-created for you.
Home Automation UIs (HABPanel, BasicUI, ClassicUI, phone apps, Habot) are the UIs that you, your family, and your guests use to operate your system. This is the UI that you give to regular users. These UIs are designed by you so you get to control what and how it gets presented to the user.
Not yet but there is some authentication and authorization in work. It may become available in 2.4. With this we might be able to create username and password access to OH, but I don’t know the extent of what we will be able to do with it.
In the mean time, https://www.openhab.org/docs/installation/security.html shows how to set up a reverse proxy that implements authentication for the admin UIs.
It is important to realize though that not all configs can be made through the admin UIs. In particular, rules, certain features of Items, and sitemaps must be created by editing text files. This is what H102 is referring to with backups and using VSCode. Making sure these are backed up will be important. Protecting them from your regular users is probably less important.