What interface does the iOS app use?

I’m currently setting up security on my OH2 machine and I would like to limit external HTTPS access to only the UI needed for the iOS app to work. Does it use the REST API, so that I am fine if I limit external access to only that UI?