Unauthorized users see list of entities they do not have access to

Problem/Motivation

I have created a custom entity type, with appropriate entity access controls. I would like to allow users to view and manipulate entities they have access to per the access management via JSON API. However I have a requirement that users should not be able to gain information on how many entities there are on the system. The JSON API entity endpoints (/json/entity_type_id/bundle_id) disclose this information by returning "access denied" type of messages for each entity.

hook_jsonapi_entity_filter_access() does not affect the plain entity endpoints.

The response is something like this:

{
    "data": [],
    "jsonapi": {
        "version": "1.0",
        "meta": {
            "links": {
                "self": {
                    "href": "http://jsonapi.org/format/1.0/"
                }
            }
        }
    },
    "links": {
        "self": {
            "href": "http://mysite.lndo.site/jsonapi/my_entity/my_bundle"
        }
    },
    "meta": {
        "omitted": {
            "detail": "Some resources have been omitted because of insufficient authorization.",
            "links": {
                "help": {
                    "href": "https://www.drupal.org/docs/8/modules/json-api/filtering#filters-access-control"
                },
                "item:Klyr2un": {
                    "href": "http://mysite.lndo.site/jsonapi/my_entity/my_bundle/ad12e3d3-95cb-48eb-a11a-d0906591c2eb",
                    "meta": {
                        "rel": "item",
                        "detail": "The current user is not allowed to GET the selected resource. The 'view any unpublished content' permission is required."
                    }
                },
                "item:sIMXhH8": {
                    "href": "http://mysite.lndo.site/jsonapi/my_entity/my_bundle/697c2e6e-cb05-4bfa-961d-703a9901a4d2",
                    "meta": {
                        "rel": "item",
                        "detail": "The current user is not allowed to GET the selected resource. The 'view any unpublished content' permission is required."
                    }
                }
            }
        }
    }
}

Proposed resolution

There should be a way to hide entities that are not accessible to the user from the list of results. Maybe by modifying the list of results in a hook. What I would like the output to look like, if there are no items the user has access to:

{
    "data": [],
    "jsonapi": {
        "version": "1.0",
        "meta": {
            "links": {
                "self": {
                    "href": "http://jsonapi.org/format/1.0/"
                }
            }
        }
    },
    "links": {
        "self": {
            "href": "http://mysite.lndo.site/jsonapi/my_entity/my_bundle"
        }
    },
    "meta": {
        "omitted": {
            "detail": "Some resources have been omitted because of insufficient authorization.",
            "links": {
                "help": {
                    "href": "https://www.drupal.org/docs/8/modules/json-api/filtering#filters-access-control"
                }
            }
        }
    }
}