How do you limit the queries allowed in the UI aka prevent someone from making a really slow / large query? Do you general not use supabase directly in the UI and write an API that your front end can call instead?
You can also be fully restrictive by only allowing the client to call the custom SQL functions[2] you define. In Supabase this is done by having all your tables in a "private" schema and only SQL functions in the "public" schema(whose db objects get exposed to the client).
[1]: https://postgrest.org/en/stable/api.html#custom-queries