There is no official documentation on the usage of the API. But there is API documentation available for the Import classes of the public API -- and the web methods are almost identical. So if you know how to import/export using the API, you'll likely know how to do the same with the web service. I'll see if we can put some example code out there for people interested in it.
Anyway, the security question you ask is a bit more interesting. Users are, of course, authorized within Tridion and constrained to the rights and permissions they have there. But mostly, if you can Import you are also allowed to Export.
However, this is a WCF web service and hosted in IIS. So you can apply security rules there to restrict who can access the web service and who cannot. I'd certainly recommend that you lock down the IP addresses and user credentials that can access it, so that you can control who uses it.
If you control who can access it, it's easier to lock down features too. You could, for instance, have the only client that is allowed to access the web service, and only expose the Import functionality in that client.
You could also block the streamDownload endpoint URL in your firewall to block the export -- or even go so far as to remove the download endpoint from the configuration (but be prepared for errors in the latter case).