Recommended workflow for granting only server access to API?

**Describe the content issue**:
I am new to how things are done on AWS, but basically, preventing client side accessjhhjh to an API on some services involves:
- Setting permissions to the API model for the client to none.
- Accessing the API model on the server using an API key.

But as it seems, after going through some pages of the Amplify docs, I saw that authenticating via an API key is recommended only when the API key is to be made public and not when trying to prevent client side access to the API. This got me confused, as it wasn't what I'm used to from a service like appwrite.

So what is the recommended way of allowing only my server to access my API or a specific model in it using the `@auth` directive in the schema?

I was thinking about IAM Auth, probably by setting allow to `private` and provider to `iam` on the @auth directives for the model(s). But I really know little about IAM roles and policies. According to some pages of the docs, using the `iam` value for the provider option of the `@auth` directive only works with amplify generated IAM policies. My questions here:

- Is this workflow the recommended one for my use case? If not, what is?

- How do I authenticate on my server as an IAM user in order to access the API. The `API.graphql()` function of amplify js only allows passing the `authMode`. No other means for passing credentials are included . So if I have stated in my schema that access to the model should only be granted to IAM, how do I authenticate as IAM user on the server with the required policies so I can access the model.

- What is the difference between when I use `@auth(rules: [{ allow: public, provider: iam }])` and when I use `@auth(rules: [{ allow: private, provider: iam }])`?
- If I'm trying to use API Auth, how do I supply the API itself too?

These seems to be something everyone knows, but some of us are new to the AWS Ecosystem. Any help is really appreciated. A decent explanation of how these things should be done should be present in the docs.

**URL page where content issue is**:
https://docs.amplify.aws/cli/graphql/authorization-rules/