User-Agent can always be spoofed. There are other headers you can check, but more clever bots spoof those as well. e.g. Accept, Accept-Language, Connection and some others that are not always used per object type
Lesser intelligent bots will not properly accept and send cookies, so you can protect some resources using cookies. This may have privacy implications that you should consider.
If you have resources you want to keep bots away from, then you will need to protect those resources with authentication.
If you are certain that everyone hitting your site will support keep-alive; including proxies, then you could block connections that do not support it. Some will find this option unorthadox.
Obscure options that may also limit browers and/or API clients
I have also found that some bots don't handle TLS1.2+SNI, as they are often using older libraries that do not support TLS1.2 and even less common, SNI. This will limit the ability of your users to hit API's on your site if that is relevant.
I will leave it to you to research how you might test and implement each of those things and which of them may or may not be appropriate. One size does not fit all.