Back when applications were typically designed in this way, the best practice was to limit database access to running certain stored procedures on a per-client

Back when applications were typically designed in this way, the best practice was to limit database access to running certain stored procedures on a per-client basis, and use those stored procedures as the client's "API" to the data.