I think you can use either a lifecycle hook or do it in a middleware and inject the response only returning items that belong to the user that created them. I personally haven’t tried that approach yet, but now I am curious how it would work.
Checkout this example here from Derrick https://github.com/strapi-support-demo-apps/strapi-example-v4-ctm-route-middleware/blob/main/src/index.js