I don't understand.
If you can not change the application, how do you know what filter you need to apply when someone just call GET /_search? There's no parameter to decide... I think I'm lost.
Anyway, I wrote a long time ago how to write a plugin which adds a REST endpoint. That does not intercept your requests and add some filters though.
May be this can be a source of inspiration though: https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/SecurityRestFilter.java (this code is not under Apache2 License though but that could help).