You could argue that it should be impossible to bypass the api, by not granting privileges on the table to the users, only the execute privilege on the api. And to be really sure you can even revoke the create session privilege of the owner schema.
This way, you can ensure that the sequence is used every time. Plus you get the added bonus of not having to use a database trigger. I've tested it as being 25-30% faster than using a database trigger.