Modify the medialib.esp file to return a 403 on response to the media library when the user "nobody" makes the request. The user "nobody" is the default anonymous user that the publish instance uses internally.
Patch /libs/CFC/templates/medialib/medialib.esp in your publish instance as follows:
Wrap the contents of medialib.esp with the following code.
<%
if( actuser.handle == "/access/users/superuser/system/nobody" ) { response.status = 403;
} else {
%> [contents of medialib.esp]
<%
}
%>