I think that's all fine, but implementing this restriction comes at a cost of maintainability. I'd say a much more pragmatic solution would be to allow a maximum of a few characters on the backend (say 10, because unicode) and then restrict the input on the front-end. If someone is willing enough to put other characters in that field by submitting the API request themselves, so be it - but it's also completely reasonable to turn around and tell them the reason their views don't look correct is because they submitted invalid data.
The reality is these users will be very few and far between, and as long as it doesn't pose a security risk there are very few benefits to strongly enforcing this limitation.
This interview with one of the founders from Jeff Geerling was quite insightful, definitely check it out if you haven't already! https://youtu.be/-_aL9V0JsQQ
The reality is these users will be very few and far between, and as long as it doesn't pose a security risk there are very few benefits to strongly enforcing this limitation.