1. You will have to separate out the service as it is not possible to hide any Public method for any client.
2. Also you can pass ID of Client in all Web Methods and keep in record in datable table where you can save permissions to WebMethod.
Thus if the Client does not have permission you can throw an error or Exception which will make it unusable for the client.
That's how FaceBook, Google and other companies do for the APIs.