They have what you are looking for with their X-Pack Security addition, which requires a license, though under very favourable terms compared to others...
Re:Elasticsearch 6.0.0 GA released
by notyourwork on Tuesday November 14, 2017 @08:54PM
(#15700908)
Hamburgers also don't have ham, you are missing the point.
It is a fantastic idea to call the index directly from the frontend and could be solved with a read only type of index or api key with read only scope.
The current design with an unnecessary security layer outside of Elasticsearch is a poor idea adding too much administrative overhead and ridiculous latency.