I am also facing same issue like for role "Student" I have set "Create User" permission "Prohibit" but still using token I am able to create user from student credentials throught REST API.
And we can only select one capability for single external service.
so token we get at login/token.php for service1, can we use it to call service2 ?
Can you help me with this issue ?