You can point your domain at your CloudFront distribution then you have 2 origins - one for your S3 app and one pointing to your Amplify app. Make the S3 origin your default behaviour, then add another behaviour for /users/*
(or whatever) and point that at your Amplify origin.