I am in need of advice on how best to tackle the following scenario and best practices to implement it.

Our company wants to overhaul its old IT systems and create new website app(s) and possibly mobile apps down the line for its employees and contractors to interact with.

So i was thinking about creating an api that both the website apps and mobile apps could be created from...

<https://api.company.com/v1>

The advice i need is in relation to security/authorization of the api. My thoughts at present in how to implement this would be that the employees/contractors would interact with the api through the companys website app(s)/mobile apps which would then communicate with the api and set the appropriate access permissions

WebsiteApp.company.com ->>> api.company.com/v1  

mobileapp ->>> api.company.com/v1

First thoughts is just setting up a username and password for each user on the api side and let both the websiteapps and mobile apps use this. The problem however is that the contractors and possible some employees cannot be fully trusted and could pass on username and passwords to third parties without the company's permission. So my question is really what other security/authorization/authentication strategies should i be looking at to overcome this situation. In a perfect world each user would have to authorize each device/mobileapp/websiteapp he/she wants to access the api from...

Is OAuth 2.0 capable of this?, not sure if its capable of specific user/device/website scenario though ?

Technologies thinking of using are:-

API

Node.js with (Express js? or Restify?) , MongoDb 

Consumer Apps 

Website Apps (Angular Js, Backbone etc..)  

Mobile Apps (PhoneGap, Jquery Mobile etc..)

Many Thanks

Jonathan