A bucket policy can restrict access to only Access Points, which can in turn be restricted to VPC endpoints.