Yes, the "wallet" in the node contains the private keys for multiple addresses, so you can consider this as multiple "wallets" if you like (it's just a question of terminology). Any process which has direct access to the node API can spend funds from any of these addresses (and can control which using the *from API calls).
To safely allow sharing of the node between multiple users, you should create a separate API layer as you suggest. You might also want to consider using watch-only addresses (importaddress call) and holding the private keys outside the MultiChain wallet, although that will be more complicated because you need to manually sign the transactions.