I know we can add an allowed principal for a folder using arcgis admin:
I'm aware this is a bit late, but as I was just working on something similar myself I figured this might interest people finding this:
You'll have to call the permissions/add endpoint with principal=esriEveryone and isAllowed=false. This should clear that permission from the service or folder.