How to Restrict Access to all wp-admin pages for subscriber users

Hence, I want to block access of subscribers to all wp-admin
menus/plugin pages including this link
https://mywebsite.com/wp-admin/user-edit.php?user_id=113

This isn’t a bulletproof solution, but it should work in that non-admin users would no longer be able to access any admin pages when they’re logged-in:

add_action( 'admin_init', function () {
    if ( wp_doing_ajax() || ! is_user_logged_in() ) {
        return;
    }

    $roles = (array) wp_get_current_user()->roles;
    if ( ! in_array( 'administrator', $roles ) ) { // allows only the Administrator role
        wp_die( 'Sorry, you are not allowed to access this page.' );
        // or you can redirect the user to somewhere, if you want to
    }
} );

But then, you might want to change the login and registration redirect URL so that it doesn’t send the user to an admin page upon successful login/registration — see the documentation for login_redirect and registration_redirect.

Problem with that is that they can then create an API key (through
application passwords plugin which is accessible from that page).

I can’t help you with that plugin, but unless if you’re still using WordPress prior to v5.6.0, then you should not need to use a plugin anymore because application passwords has been a core feature in WordPress since v5.6.0. And there’s actually a hook named wp_is_application_passwords_available_for_user that you could use to disable the feature for certain users.

This is undesirable as I dont want the users to have API keys where
they can fetch/post data to server.

If so, and since you said in your comment, “The rest api is restricted for authenticated users“, then how about using the rest_authentication_errors hook to ensure only Administrators allowed to access the REST API?

Working example:

add_filter( 'rest_authentication_errors', function ( $errors ) {
    if ( ! is_wp_error( $errors ) ) { // do nothing if there's already an error
        if ( $can_access = is_user_logged_in() ) {
            $roles      = (array) wp_get_current_user()->roles;
            $can_access = in_array( 'administrator', $roles ); // allows only the Administrator role
        }

        if ( ! $can_access ) {
            return new WP_Error( 'user_not_allowed',
                'Sorry, you are not allowed to access the REST API.',
                array( 'status' => rest_authorization_required_code() )
            );
        }
    }

    return $errors;
} );

tech