Edit: Scratch this, see David’s post above. I didn’t realize a setting existed!
The simplest way would be to hide it using CSS, we add the anon class to the html tag when someone isn’t logged in.
.anon #whos-online {
display: none;
}
Because we don’t know who they are, so we couldn’t effectively put them into a group.