Is there a way to prevent user updating their preferences?

I want to store some user data in the preferences. However, I don't want users to be able to modify it by directly querying the API. Basically, I want user preferences to be editable only by the server, not the client. Is there a way to achieve this, and should I rely on this approach, or would it be better to create a separate database for this purpose?

Every user can edit their own preferences. If you don't to allow that, create a new collection and allow read permission to it. edit it via a server sdk or server sdk + function.

Thanks