You probably want to suspend all users so that they aren’t getting sent emails, which would keep them from being able to log in even if they should stumble on the site.
If that’s somehow not good enough, you could modify the nginx in the container to require bait auth in order to get to the site.