The "PRIVATE" and "PUBLIC" parts of your URLs are part of the stream name. So if it is just RTMP clients, you could use could override play to restrict playback
as shown in this example. If other client types are involved you could use
IMediaStreamNameAliasProvider2 to look at what play requests and block as necessary.