@MichaelJenkins is right on point 1, that option puts your org in "lockdown" mode where members of the public see nothing.
On point number 2, a user can still see your maps and data, they just won't know what your service URLs are unless they watch the network traffic when the map loads.
Various versions of this question come up now and then, but the answer is pretty much the same: if the data is public, you can't stop someone from viewing the data in other contexts, or even downloading it. You can make it inconvenient, but not totally stop it.
There are ways to actually show the data publicly without opening up other kinds of access, but it requires custom coding. No way to do it with off-the-shelf tools that I know of.
- Josh Carlson
Kendall County GIS