Ephemeral, IP Bound API Keys with Per Key Rate Limits.
You could have some kind of "/api-key" endpoint that serves up an ephemeral api key. Make sure it's unavailable cross domain. That key would be used to access your endpoint, but it would only be valid for a certain amount of time. Make it sticky by requesting ip address. Meaning if the same client requests it multiple times, they get the same key, until it expires.
Then put a gateway or proxy in front of your rpc endpoint that will authorize the api key, possibly rate limit it, and importantly, check its expiration.
This way if someone copies it and pastes it into their own dApp, it would quickly stop working.
I suppose, if they REALLY wanted to use your endpoint, they could host an "/api-key" endpoint of their own that proxies through to yours. But at that point they are really going out of their way to be abusive.
Also, you can rate limit them, without throttling your other users, because they'll have a different api key than everyone else. Essentially, everyone using their site, will be sharing the same api key, while all the users on your site, will get their own api key. With each api-key having its own rate limit state.
It gets to a point where it's cheaper, and easier for them to just get their own endpoint.