It all depends on what your end goal is. Here are a few options that I can think of:
a) Disable Service Directory:
You might be aware of this option where you can disable anyone from accessing the Service Directory. But that won't prevent one with url from accessing your data.
https://enterprise.arcgis.com/en/server/latest/administer/linux/disabling-the-services-directory.htm
b) Disable 'data' mapping capability:
You can disable 'Data' mapping capability that will prevent anyone from submitting any query request.
https://enterprise.arcgis.com/en/server/latest/publish-services/linux/edit-map-service-settings.htm#...
... that also means that you can't add a layer off a map service as a 'feature layer' to your web app including ExB. You must add the service as a 'map image layer'.
At that point, the popup would still work, as the popup will use the /identify operation. But no one can bulk download your data very easily. And if you try to open 'table' for a sublayer from the map image layer, it won't work. Charts and some other widgets might not work.
c) Turn off 'query' mapping capability:
just like (b) you can also turn off query capability that will prevent anyone making /identify request. This prevents one from accessing your data entirely. You can still add that service as a 'map image layer'; features will draw fine on the map; but you won't see any popup.
With this option you will only be able to visualize features on the map. Nothing else can be done.
I hope this helps.
