Prevent a script from executing by placing the URL in the address bar

I have a question with security related to AJAX, my code is the following

    "ajax": {
             url: '../ajax/usuarios.php?op=listar',
             type : "get",
             dataType : "json",                     
             error: function(e){
             console.log(e.responseText);   
    }
},

If they place directly in the browser with the value of the variable, it makes me consult the database and this query should only be done by some users with privileges.

Do you know any way to prevent me from making the query with the URL (../ ajax / usuarios.php? op = list)?