The easiest way to track down what you need to modify is looking at it from this perspective:
You know the route, in your case FIND /users thus we need to look at where that route comes from. We know in this case it’s the users-permissions plugin, and routes are always stored in the config/routes.json Thus:
Specifically what we are looking for is the handler or in this case: "handler": "User.find",. The Handler is a Koa term which for Strapi translates to a controller, the pathing you see there means we are now looking inside of the users-permission’s controller folder. The handler tells us it’s in the User.js file under the find function.
Just like in the previous example I gave you there is a populate variable that could change based on the request:
users = await strapi.plugins['users-permissions'].services.user.fetchAll(ctx.query, populate);
And the specific line here: { populate } = {} states if it isn’t defined, just leave it as an empty object or AKA the default population of 1 level deep.
Much like the previous example I gave you for the /users/me, this service comes from the exact same place just a few lines below:
The same logic applies, if you pass an empty array, nothing will be populated or you include the fields you want populated.